@saltcorn/sql 0.4.0 → 0.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/table-provider.js +6 -2
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@saltcorn/sql",
3
- "version": "0.4.0",
3
+ "version": "0.4.1",
4
4
  "description": "Actions and views based on SQL",
5
5
  "main": "index.js",
6
6
  "dependencies": {
package/table-provider.js CHANGED
@@ -275,7 +275,11 @@ const runQuery = async (cfg, where, opts) => {
275
275
  if (typeof orderBy === "string")
276
276
  ast[0].orderby = [
277
277
  {
278
- expr: { type: "column_ref", table: null, column: orderBy },
278
+ expr: {
279
+ type: "column_ref",
280
+ table: null,
281
+ column: db.sqlsanitize(orderBy),
282
+ },
279
283
  type: orderDesc ? "DESC" : "ASC",
280
284
  },
281
285
  ];
@@ -293,7 +297,7 @@ const runQuery = async (cfg, where, opts) => {
293
297
  left: {
294
298
  type: "column_ref",
295
299
  table: null,
296
- column: field,
300
+ column: db.sqlsanitize(field),
297
301
  },
298
302
  right: {
299
303
  type: "number",