directus 9.23.1 → 9.23.4

package/dist/controllers/flows.js

@@ -12,11 +12,12 @@ const use_collection_1 = __importDefault(require("../middleware/use-collection")
 const validate_batch_1 = require("../middleware/validate-batch");
 const services_1 = require("../services");
 const async_handler_1 = __importDefault(require("../utils/async-handler"));
+const sanitize_query_1 = require("../utils/sanitize-query");
 const router = express_1.default.Router();
 router.use((0, use_collection_1.default)('directus_flows'));
 const webhookFlowHandler = (0, async_handler_1.default)(async (req, res, next) => {
     const flowManager = (0, flows_1.getFlowManager)();
-    const result = await flowManager.runWebhookFlow(`${req.method}-${req.params.pk}`, {
+    const result = await flowManager.runWebhookFlow(`${req.method}-${req.params['pk']}`, {
         path: req.path,
         query: req.query,
         body: req.body,
@@ -26,7 +27,7 @@ const webhookFlowHandler = (0, async_handler_1.default)(async (req, res, next) =
         accountability: req.accountability,
         schema: req.schema,
     });
-    res.locals.payload = result;
+    res.locals['payload'] = result;
     return next();
 });
 router.get(`/trigger/:pk(${constants_1.UUID_REGEX})`, webhookFlowHandler, respond_1.respond);
@@ -48,11 +49,11 @@ router.post('/', (0, async_handler_1.default)(async (req, res, next) => {
     try {
         if (Array.isArray(req.body)) {
             const items = await service.readMany(savedKeys, req.sanitizedQuery);
-            res.locals.payload = { data: items };
+            res.locals['payload'] = { data: items };
         }
         else {
             const item = await service.readOne(savedKeys[0], req.sanitizedQuery);
-            res.locals.payload = { data: item };
+            res.locals['payload'] = { data: item };
         }
     }
     catch (error) {
@@ -74,7 +75,7 @@ const readHandler = (0, async_handler_1.default)(async (req, res, next) => {
     });
     const records = await service.readByQuery(req.sanitizedQuery);
     const meta = await metaService.getMetaForQuery(req.collection, req.sanitizedQuery);
-    res.locals.payload = { data: records || null, meta };
+    res.locals['payload'] = { data: records || null, meta };
     return next();
 });
 router.get('/', (0, validate_batch_1.validateBatch)('read'), readHandler, respond_1.respond);
@@ -84,8 +85,8 @@ router.get('/:pk', (0, async_handler_1.default)(async (req, res, next) => {
         accountability: req.accountability,
         schema: req.schema,
     });
-    const record = await service.readOne(req.params.pk, req.sanitizedQuery);
-    res.locals.payload = { data: record || null };
+    const record = await service.readOne(req.params['pk'], req.sanitizedQuery);
+    res.locals['payload'] = { data: record || null };
     return next();
 }), respond_1.respond);
 router.patch('/', (0, validate_batch_1.validateBatch)('update'), (0, async_handler_1.default)(async (req, res, next) => {
@@ -101,11 +102,12 @@ router.patch('/', (0, validate_batch_1.validateBatch)('update'), (0, async_handl
         keys = await service.updateMany(req.body.keys, req.body.data);
     }
     else {
-        keys = await service.updateByQuery(req.body.query, req.body.data);
+        const sanitizedQuery = (0, sanitize_query_1.sanitizeQuery)(req.body.query, req.accountability);
+        keys = await service.updateByQuery(sanitizedQuery, req.body.data);
     }
     try {
         const result = await service.readMany(keys, req.sanitizedQuery);
-        res.locals.payload = { data: result };
+        res.locals['payload'] = { data: result };
     }
     catch (error) {
         if (error instanceof exceptions_1.ForbiddenException) {
@@ -120,10 +122,10 @@ router.patch('/:pk', (0, async_handler_1.default)(async (req, res, next) => {
         accountability: req.accountability,
         schema: req.schema,
     });
-    const primaryKey = await service.updateOne(req.params.pk, req.body);
+    const primaryKey = await service.updateOne(req.params['pk'], req.body);
     try {
         const item = await service.readOne(primaryKey, req.sanitizedQuery);
-        res.locals.payload = { data: item || null };
+        res.locals['payload'] = { data: item || null };
     }
     catch (error) {
         if (error instanceof exceptions_1.ForbiddenException) {
@@ -145,7 +147,8 @@ router.delete('/', (0, async_handler_1.default)(async (req, res, next) => {
         await service.deleteMany(req.body.keys);
     }
     else {
-        await service.deleteByQuery(req.body.query);
+        const sanitizedQuery = (0, sanitize_query_1.sanitizeQuery)(req.body.query, req.accountability);
+        await service.deleteByQuery(sanitizedQuery);
     }
     return next();
 }), respond_1.respond);
@@ -154,7 +157,7 @@ router.delete('/:pk', (0, async_handler_1.default)(async (req, res, next) => {
         accountability: req.accountability,
         schema: req.schema,
     });
-    await service.deleteOne(req.params.pk);
+    await service.deleteOne(req.params['pk']);
     return next();
 }), respond_1.respond);
 exports.default = router;

package/dist/controllers/folders.js

@@ -10,6 +10,7 @@ const use_collection_1 = __importDefault(require("../middleware/use-collection")
 const validate_batch_1 = require("../middleware/validate-batch");
 const services_1 = require("../services");
 const async_handler_1 = __importDefault(require("../utils/async-handler"));
+const sanitize_query_1 = require("../utils/sanitize-query");
 const router = express_1.default.Router();
 router.use((0, use_collection_1.default)('directus_folders'));
 router.post('/', (0, async_handler_1.default)(async (req, res, next) => {
@@ -29,11 +30,11 @@ router.post('/', (0, async_handler_1.default)(async (req, res, next) => {
     try {
         if (Array.isArray(req.body)) {
             const records = await service.readMany(savedKeys, req.sanitizedQuery);
-            res.locals.payload = { data: records };
+            res.locals['payload'] = { data: records };
         }
         else {
             const record = await service.readOne(savedKeys[0], req.sanitizedQuery);
-            res.locals.payload = { data: record };
+            res.locals['payload'] = { data: record };
         }
     }
     catch (error) {
@@ -64,7 +65,7 @@ const readHandler = (0, async_handler_1.default)(async (req, res, next) => {
         result = await service.readByQuery(req.sanitizedQuery);
     }
     const meta = await metaService.getMetaForQuery('directus_folders', req.sanitizedQuery);
-    res.locals.payload = { data: result, meta };
+    res.locals['payload'] = { data: result, meta };
     return next();
 });
 router.get('/', (0, validate_batch_1.validateBatch)('read'), readHandler, respond_1.respond);
@@ -74,8 +75,8 @@ router.get('/:pk', (0, async_handler_1.default)(async (req, res, next) => {
         accountability: req.accountability,
         schema: req.schema,
     });
-    const record = await service.readOne(req.params.pk, req.sanitizedQuery);
-    res.locals.payload = { data: record || null };
+    const record = await service.readOne(req.params['pk'], req.sanitizedQuery);
+    res.locals['payload'] = { data: record || null };
     return next();
 }), respond_1.respond);
 router.patch('/', (0, validate_batch_1.validateBatch)('update'), (0, async_handler_1.default)(async (req, res, next) => {
@@ -91,11 +92,12 @@ router.patch('/', (0, validate_batch_1.validateBatch)('update'), (0, async_handl
         keys = await service.updateMany(req.body.keys, req.body.data);
     }
     else {
-        keys = await service.updateByQuery(req.body.query, req.body.data);
+        const sanitizedQuery = (0, sanitize_query_1.sanitizeQuery)(req.body.query, req.accountability);
+        keys = await service.updateByQuery(sanitizedQuery, req.body.data);
     }
     try {
         const result = await service.readMany(keys, req.sanitizedQuery);
-        res.locals.payload = { data: result || null };
+        res.locals['payload'] = { data: result || null };
     }
     catch (error) {
         if (error instanceof exceptions_1.ForbiddenException) {
@@ -110,10 +112,10 @@ router.patch('/:pk', (0, async_handler_1.default)(async (req, res, next) => {
         accountability: req.accountability,
         schema: req.schema,
     });
-    const primaryKey = await service.updateOne(req.params.pk, req.body);
+    const primaryKey = await service.updateOne(req.params['pk'], req.body);
     try {
         const record = await service.readOne(primaryKey, req.sanitizedQuery);
-        res.locals.payload = { data: record || null };
+        res.locals['payload'] = { data: record || null };
     }
     catch (error) {
         if (error instanceof exceptions_1.ForbiddenException) {
@@ -135,7 +137,8 @@ router.delete('/', (0, validate_batch_1.validateBatch)('delete'), (0, async_hand
         await service.deleteMany(req.body.keys);
     }
     else {
-        await service.deleteByQuery(req.body.query);
+        const sanitizedQuery = (0, sanitize_query_1.sanitizeQuery)(req.body.query, req.accountability);
+        await service.deleteByQuery(sanitizedQuery);
     }
     return next();
 }), respond_1.respond);
@@ -144,7 +147,7 @@ router.delete('/:pk', (0, async_handler_1.default)(async (req, res, next) => {
         accountability: req.accountability,
         schema: req.schema,
     });
-    await service.deleteOne(req.params.pk);
+    await service.deleteOne(req.params['pk']);
     return next();
 }), respond_1.respond);
 exports.default = router;

package/dist/controllers/graphql.js

@@ -10,28 +10,26 @@ const services_1 = require("../services");
 const async_handler_1 = __importDefault(require("../utils/async-handler"));
 const router = (0, express_1.Router)();
 router.use('/system', graphql_1.parseGraphQL, (0, async_handler_1.default)(async (req, res, next) => {
-    var _a, _b;
     const service = new services_1.GraphQLService({
         accountability: req.accountability,
         schema: req.schema,
         scope: 'system',
     });
-    res.locals.payload = await service.execute(res.locals.graphqlParams);
-    if (((_b = (_a = res.locals.payload) === null || _a === void 0 ? void 0 : _a.errors) === null || _b === void 0 ? void 0 : _b.length) > 0) {
-        res.locals.cache = false;
+    res.locals['payload'] = await service.execute(res.locals['graphqlParams']);
+    if (res.locals['payload']?.errors?.length > 0) {
+        res.locals['cache'] = false;
     }
     return next();
 }), respond_1.respond);
 router.use('/', graphql_1.parseGraphQL, (0, async_handler_1.default)(async (req, res, next) => {
-    var _a, _b;
     const service = new services_1.GraphQLService({
         accountability: req.accountability,
         schema: req.schema,
         scope: 'items',
     });
-    res.locals.payload = await service.execute(res.locals.graphqlParams);
-    if (((_b = (_a = res.locals.payload) === null || _a === void 0 ? void 0 : _a.errors) === null || _b === void 0 ? void 0 : _b.length) > 0) {
-        res.locals.cache = false;
+    res.locals['payload'] = await service.execute(res.locals['graphqlParams']);
+    if (res.locals['payload']?.errors?.length > 0) {
+        res.locals['cache'] = false;
     }
     return next();
 }), respond_1.respond);

package/dist/controllers/items.js

@@ -10,9 +10,10 @@ const respond_1 = require("../middleware/respond");
 const validate_batch_1 = require("../middleware/validate-batch");
 const services_1 = require("../services");
 const async_handler_1 = __importDefault(require("../utils/async-handler"));
+const sanitize_query_1 = require("../utils/sanitize-query");
 const router = express_1.default.Router();
 router.post('/:collection', collection_exists_1.default, (0, async_handler_1.default)(async (req, res, next) => {
-    if (req.params.collection.startsWith('directus_'))
+    if (req.params['collection'].startsWith('directus_'))
         throw new exceptions_1.ForbiddenException();
     if (req.singleton) {
         throw new exceptions_1.RouteNotFoundException(req.path);
@@ -33,11 +34,11 @@ router.post('/:collection', collection_exists_1.default, (0, async_handler_1.def
     try {
         if (Array.isArray(req.body)) {
             const result = await service.readMany(savedKeys, req.sanitizedQuery);
-            res.locals.payload = { data: result || null };
+            res.locals['payload'] = { data: result || null };
         }
         else {
             const result = await service.readOne(savedKeys[0], req.sanitizedQuery);
-            res.locals.payload = { data: result || null };
+            res.locals['payload'] = { data: result || null };
         }
     }
     catch (error) {
@@ -49,7 +50,7 @@ router.post('/:collection', collection_exists_1.default, (0, async_handler_1.def
     return next();
 }), respond_1.respond);
 const readHandler = (0, async_handler_1.default)(async (req, res, next) => {
-    if (req.params.collection.startsWith('directus_'))
+    if (req.params['collection'].startsWith('directus_'))
         throw new exceptions_1.ForbiddenException();
     const service = new services_1.ItemsService(req.collection, {
         accountability: req.accountability,
@@ -70,7 +71,7 @@ const readHandler = (0, async_handler_1.default)(async (req, res, next) => {
         result = await service.readByQuery(req.sanitizedQuery);
     }
     const meta = await metaService.getMetaForQuery(req.collection, req.sanitizedQuery);
-    res.locals.payload = {
+    res.locals['payload'] = {
         meta: meta,
         data: result,
     };
@@ -79,20 +80,20 @@ const readHandler = (0, async_handler_1.default)(async (req, res, next) => {
 router.search('/:collection', collection_exists_1.default, (0, validate_batch_1.validateBatch)('read'), readHandler, respond_1.respond);
 router.get('/:collection', collection_exists_1.default, readHandler, respond_1.respond);
 router.get('/:collection/:pk', collection_exists_1.default, (0, async_handler_1.default)(async (req, res, next) => {
-    if (req.params.collection.startsWith('directus_'))
+    if (req.params['collection'].startsWith('directus_'))
         throw new exceptions_1.ForbiddenException();
     const service = new services_1.ItemsService(req.collection, {
         accountability: req.accountability,
         schema: req.schema,
     });
-    const result = await service.readOne(req.params.pk, req.sanitizedQuery);
-    res.locals.payload = {
+    const result = await service.readOne(req.params['pk'], req.sanitizedQuery);
+    res.locals['payload'] = {
         data: result || null,
     };
     return next();
 }), respond_1.respond);
 router.patch('/:collection', collection_exists_1.default, (0, validate_batch_1.validateBatch)('update'), (0, async_handler_1.default)(async (req, res, next) => {
-    if (req.params.collection.startsWith('directus_'))
+    if (req.params['collection'].startsWith('directus_'))
         throw new exceptions_1.ForbiddenException();
     const service = new services_1.ItemsService(req.collection, {
         accountability: req.accountability,
@@ -101,7 +102,7 @@ router.patch('/:collection', collection_exists_1.default, (0, validate_batch_1.v
     if (req.singleton === true) {
         await service.upsertSingleton(req.body);
         const item = await service.readSingleton(req.sanitizedQuery);
-        res.locals.payload = { data: item || null };
+        res.locals['payload'] = { data: item || null };
         return next();
     }
     let keys = [];
@@ -112,11 +113,12 @@ router.patch('/:collection', collection_exists_1.default, (0, validate_batch_1.v
         keys = await service.updateMany(req.body.keys, req.body.data);
     }
     else {
-        keys = await service.updateByQuery(req.body.query, req.body.data);
+        const sanitizedQuery = (0, sanitize_query_1.sanitizeQuery)(req.body.query, req.accountability);
+        keys = await service.updateByQuery(sanitizedQuery, req.body.data);
     }
     try {
         const result = await service.readMany(keys, req.sanitizedQuery);
-        res.locals.payload = { data: result };
+        res.locals['payload'] = { data: result };
     }
     catch (error) {
         if (error instanceof exceptions_1.ForbiddenException) {
@@ -127,7 +129,7 @@ router.patch('/:collection', collection_exists_1.default, (0, validate_batch_1.v
     return next();
 }), respond_1.respond);
 router.patch('/:collection/:pk', collection_exists_1.default, (0, async_handler_1.default)(async (req, res, next) => {
-    if (req.params.collection.startsWith('directus_'))
+    if (req.params['collection'].startsWith('directus_'))
         throw new exceptions_1.ForbiddenException();
     if (req.singleton) {
         throw new exceptions_1.RouteNotFoundException(req.path);
@@ -136,10 +138,10 @@ router.patch('/:collection/:pk', collection_exists_1.default, (0, async_handler_
         accountability: req.accountability,
         schema: req.schema,
     });
-    const updatedPrimaryKey = await service.updateOne(req.params.pk, req.body);
+    const updatedPrimaryKey = await service.updateOne(req.params['pk'], req.body);
     try {
         const result = await service.readOne(updatedPrimaryKey, req.sanitizedQuery);
-        res.locals.payload = { data: result || null };
+        res.locals['payload'] = { data: result || null };
     }
     catch (error) {
         if (error instanceof exceptions_1.ForbiddenException) {
@@ -150,7 +152,7 @@ router.patch('/:collection/:pk', collection_exists_1.default, (0, async_handler_
     return next();
 }), respond_1.respond);
 router.delete('/:collection', collection_exists_1.default, (0, validate_batch_1.validateBatch)('delete'), (0, async_handler_1.default)(async (req, res, next) => {
-    if (req.params.collection.startsWith('directus_'))
+    if (req.params['collection'].startsWith('directus_'))
         throw new exceptions_1.ForbiddenException();
     const service = new services_1.ItemsService(req.collection, {
         accountability: req.accountability,
@@ -163,18 +165,19 @@ router.delete('/:collection', collection_exists_1.default, (0, validate_batch_1.
         await service.deleteMany(req.body.keys);
     }
     else {
-        await service.deleteByQuery(req.body.query);
+        const sanitizedQuery = (0, sanitize_query_1.sanitizeQuery)(req.body.query, req.accountability);
+        await service.deleteByQuery(sanitizedQuery);
     }
     return next();
 }), respond_1.respond);
 router.delete('/:collection/:pk', collection_exists_1.default, (0, async_handler_1.default)(async (req, res, next) => {
-    if (req.params.collection.startsWith('directus_'))
+    if (req.params['collection'].startsWith('directus_'))
         throw new exceptions_1.ForbiddenException();
     const service = new services_1.ItemsService(req.collection, {
         accountability: req.accountability,
         schema: req.schema,
     });
-    await service.deleteOne(req.params.pk);
+    await service.deleteOne(req.params['pk']);
     return next();
 }), respond_1.respond);
 exports.default = router;

package/dist/controllers/not-found.d.ts

@@ -1,4 +1,4 @@
-import { RequestHandler } from 'express';
+import type { RequestHandler } from 'express';
 /**
  * Handles not found routes.
  *

package/dist/controllers/not-found.js

@@ -18,12 +18,11 @@ const exceptions_1 = require("../exceptions");
  * @param next
  */
 const notFound = async (req, res, next) => {
-    var _a;
     try {
         const hooksResult = await emitter_1.default.emitFilter('request.not_found', false, { request: req, response: res }, {
             database: (0, database_1.default)(),
             schema: req.schema,
-            accountability: (_a = req.accountability) !== null && _a !== void 0 ? _a : null,
+            accountability: req.accountability ?? null,
         });
         if (hooksResult) {
             return next();

package/dist/controllers/notifications.js

@@ -10,6 +10,7 @@ const use_collection_1 = __importDefault(require("../middleware/use-collection")
 const validate_batch_1 = require("../middleware/validate-batch");
 const services_1 = require("../services");
 const async_handler_1 = __importDefault(require("../utils/async-handler"));
+const sanitize_query_1 = require("../utils/sanitize-query");
 const router = express_1.default.Router();
 router.use((0, use_collection_1.default)('directus_notifications'));
 router.post('/', (0, async_handler_1.default)(async (req, res, next) => {
@@ -29,11 +30,11 @@ router.post('/', (0, async_handler_1.default)(async (req, res, next) => {
     try {
         if (Array.isArray(req.body)) {
             const records = await service.readMany(savedKeys, req.sanitizedQuery);
-            res.locals.payload = { data: records };
+            res.locals['payload'] = { data: records };
         }
         else {
             const record = await service.readOne(savedKeys[0], req.sanitizedQuery);
-            res.locals.payload = { data: record };
+            res.locals['payload'] = { data: record };
         }
     }
     catch (error) {
@@ -64,7 +65,7 @@ const readHandler = (0, async_handler_1.default)(async (req, res, next) => {
         result = await service.readByQuery(req.sanitizedQuery);
     }
     const meta = await metaService.getMetaForQuery('directus_notifications', req.sanitizedQuery);
-    res.locals.payload = { data: result, meta };
+    res.locals['payload'] = { data: result, meta };
     return next();
 });
 router.get('/', (0, validate_batch_1.validateBatch)('read'), readHandler, respond_1.respond);
@@ -74,8 +75,8 @@ router.get('/:pk', (0, async_handler_1.default)(async (req, res, next) => {
         accountability: req.accountability,
         schema: req.schema,
     });
-    const record = await service.readOne(req.params.pk, req.sanitizedQuery);
-    res.locals.payload = { data: record || null };
+    const record = await service.readOne(req.params['pk'], req.sanitizedQuery);
+    res.locals['payload'] = { data: record || null };
     return next();
 }), respond_1.respond);
 router.patch('/', (0, validate_batch_1.validateBatch)('update'), (0, async_handler_1.default)(async (req, res, next) => {
@@ -91,11 +92,12 @@ router.patch('/', (0, validate_batch_1.validateBatch)('update'), (0, async_handl
         keys = await service.updateMany(req.body.keys, req.body.data);
     }
     else {
-        keys = await service.updateByQuery(req.body.query, req.body.data);
+        const sanitizedQuery = (0, sanitize_query_1.sanitizeQuery)(req.body.query, req.accountability);
+        keys = await service.updateByQuery(sanitizedQuery, req.body.data);
     }
     try {
         const result = await service.readMany(keys, req.sanitizedQuery);
-        res.locals.payload = { data: result };
+        res.locals['payload'] = { data: result };
     }
     catch (error) {
         if (error instanceof exceptions_1.ForbiddenException) {
@@ -110,10 +112,10 @@ router.patch('/:pk', (0, async_handler_1.default)(async (req, res, next) => {
         accountability: req.accountability,
         schema: req.schema,
     });
-    const primaryKey = await service.updateOne(req.params.pk, req.body);
+    const primaryKey = await service.updateOne(req.params['pk'], req.body);
     try {
         const record = await service.readOne(primaryKey, req.sanitizedQuery);
-        res.locals.payload = { data: record };
+        res.locals['payload'] = { data: record };
     }
     catch (error) {
         if (error instanceof exceptions_1.ForbiddenException) {
@@ -135,7 +137,8 @@ router.delete('/', (0, validate_batch_1.validateBatch)('delete'), (0, async_hand
         await service.deleteMany(req.body.keys);
     }
     else {
-        await service.deleteByQuery(req.body.query);
+        const sanitizedQuery = (0, sanitize_query_1.sanitizeQuery)(req.body.query, req.accountability);
+        await service.deleteByQuery(sanitizedQuery);
     }
     return next();
 }), respond_1.respond);
@@ -144,7 +147,7 @@ router.delete('/:pk', (0, async_handler_1.default)(async (req, res, next) => {
         accountability: req.accountability,
         schema: req.schema,
     });
-    await service.deleteOne(req.params.pk);
+    await service.deleteOne(req.params['pk']);
     return next();
 }), respond_1.respond);
 exports.default = router;

package/dist/controllers/operations.js

@@ -10,6 +10,7 @@ const use_collection_1 = __importDefault(require("../middleware/use-collection")
 const validate_batch_1 = require("../middleware/validate-batch");
 const services_1 = require("../services");
 const async_handler_1 = __importDefault(require("../utils/async-handler"));
+const sanitize_query_1 = require("../utils/sanitize-query");
 const router = express_1.default.Router();
 router.use((0, use_collection_1.default)('directus_operations'));
 router.post('/', (0, async_handler_1.default)(async (req, res, next) => {
@@ -29,11 +30,11 @@ router.post('/', (0, async_handler_1.default)(async (req, res, next) => {
     try {
         if (Array.isArray(req.body)) {
             const items = await service.readMany(savedKeys, req.sanitizedQuery);
-            res.locals.payload = { data: items };
+            res.locals['payload'] = { data: items };
         }
         else {
             const item = await service.readOne(savedKeys[0], req.sanitizedQuery);
-            res.locals.payload = { data: item };
+            res.locals['payload'] = { data: item };
         }
     }
     catch (error) {
@@ -55,7 +56,7 @@ const readHandler = (0, async_handler_1.default)(async (req, res, next) => {
     });
     const records = await service.readByQuery(req.sanitizedQuery);
     const meta = await metaService.getMetaForQuery(req.collection, req.sanitizedQuery);
-    res.locals.payload = { data: records || null, meta };
+    res.locals['payload'] = { data: records || null, meta };
     return next();
 });
 router.get('/', (0, validate_batch_1.validateBatch)('read'), readHandler, respond_1.respond);
@@ -65,8 +66,8 @@ router.get('/:pk', (0, async_handler_1.default)(async (req, res, next) => {
         accountability: req.accountability,
         schema: req.schema,
     });
-    const record = await service.readOne(req.params.pk, req.sanitizedQuery);
-    res.locals.payload = { data: record || null };
+    const record = await service.readOne(req.params['pk'], req.sanitizedQuery);
+    res.locals['payload'] = { data: record || null };
     return next();
 }), respond_1.respond);
 router.patch('/', (0, validate_batch_1.validateBatch)('update'), (0, async_handler_1.default)(async (req, res, next) => {
@@ -82,11 +83,12 @@ router.patch('/', (0, validate_batch_1.validateBatch)('update'), (0, async_handl
         keys = await service.updateMany(req.body.keys, req.body.data);
     }
     else {
-        keys = await service.updateByQuery(req.body.query, req.body.data);
+        const sanitizedQuery = (0, sanitize_query_1.sanitizeQuery)(req.body.query, req.accountability);
+        keys = await service.updateByQuery(sanitizedQuery, req.body.data);
     }
     try {
         const result = await service.readMany(keys, req.sanitizedQuery);
-        res.locals.payload = { data: result };
+        res.locals['payload'] = { data: result };
     }
     catch (error) {
         if (error instanceof exceptions_1.ForbiddenException) {
@@ -101,10 +103,10 @@ router.patch('/:pk', (0, async_handler_1.default)(async (req, res, next) => {
         accountability: req.accountability,
         schema: req.schema,
     });
-    const primaryKey = await service.updateOne(req.params.pk, req.body);
+    const primaryKey = await service.updateOne(req.params['pk'], req.body);
     try {
         const item = await service.readOne(primaryKey, req.sanitizedQuery);
-        res.locals.payload = { data: item || null };
+        res.locals['payload'] = { data: item || null };
     }
     catch (error) {
         if (error instanceof exceptions_1.ForbiddenException) {
@@ -126,7 +128,8 @@ router.delete('/', (0, async_handler_1.default)(async (req, res, next) => {
         await service.deleteMany(req.body.keys);
     }
     else {
-        await service.deleteByQuery(req.body.query);
+        const sanitizedQuery = (0, sanitize_query_1.sanitizeQuery)(req.body.query, req.accountability);
+        await service.deleteByQuery(sanitizedQuery);
     }
     return next();
 }), respond_1.respond);
@@ -135,7 +138,7 @@ router.delete('/:pk', (0, async_handler_1.default)(async (req, res, next) => {
         accountability: req.accountability,
         schema: req.schema,
     });
-    await service.deleteOne(req.params.pk);
+    await service.deleteOne(req.params['pk']);
     return next();
 }), respond_1.respond);
 exports.default = router;

package/dist/controllers/panels.js

@@ -10,6 +10,7 @@ const use_collection_1 = __importDefault(require("../middleware/use-collection")
 const validate_batch_1 = require("../middleware/validate-batch");
 const services_1 = require("../services");
 const async_handler_1 = __importDefault(require("../utils/async-handler"));
+const sanitize_query_1 = require("../utils/sanitize-query");
 const router = express_1.default.Router();
 router.use((0, use_collection_1.default)('directus_panels'));
 router.post('/', (0, async_handler_1.default)(async (req, res, next) => {
@@ -29,11 +30,11 @@ router.post('/', (0, async_handler_1.default)(async (req, res, next) => {
     try {
         if (Array.isArray(req.body)) {
             const items = await service.readMany(savedKeys, req.sanitizedQuery);
-            res.locals.payload = { data: items };
+            res.locals['payload'] = { data: items };
         }
         else {
             const item = await service.readOne(savedKeys[0], req.sanitizedQuery);
-            res.locals.payload = { data: item };
+            res.locals['payload'] = { data: item };
         }
     }
     catch (error) {
@@ -55,7 +56,7 @@ const readHandler = (0, async_handler_1.default)(async (req, res, next) => {
     });
     const records = await service.readByQuery(req.sanitizedQuery);
     const meta = await metaService.getMetaForQuery(req.collection, req.sanitizedQuery);
-    res.locals.payload = { data: records || null, meta };
+    res.locals['payload'] = { data: records || null, meta };
     return next();
 });
 router.get('/', (0, validate_batch_1.validateBatch)('read'), readHandler, respond_1.respond);
@@ -65,8 +66,8 @@ router.get('/:pk', (0, async_handler_1.default)(async (req, res, next) => {
         accountability: req.accountability,
         schema: req.schema,
     });
-    const record = await service.readOne(req.params.pk, req.sanitizedQuery);
-    res.locals.payload = { data: record || null };
+    const record = await service.readOne(req.params['pk'], req.sanitizedQuery);
+    res.locals['payload'] = { data: record || null };
     return next();
 }), respond_1.respond);
 router.patch('/', (0, validate_batch_1.validateBatch)('update'), (0, async_handler_1.default)(async (req, res, next) => {
@@ -82,11 +83,12 @@ router.patch('/', (0, validate_batch_1.validateBatch)('update'), (0, async_handl
         keys = await service.updateMany(req.body.keys, req.body.data);
     }
     else {
-        keys = await service.updateByQuery(req.body.query, req.body.data);
+        const sanitizedQuery = (0, sanitize_query_1.sanitizeQuery)(req.body.query, req.accountability);
+        keys = await service.updateByQuery(sanitizedQuery, req.body.data);
     }
     try {
         const result = await service.readMany(keys, req.sanitizedQuery);
-        res.locals.payload = { data: result };
+        res.locals['payload'] = { data: result };
     }
     catch (error) {
         if (error instanceof exceptions_1.ForbiddenException) {
@@ -101,10 +103,10 @@ router.patch('/:pk', (0, async_handler_1.default)(async (req, res, next) => {
         accountability: req.accountability,
         schema: req.schema,
     });
-    const primaryKey = await service.updateOne(req.params.pk, req.body);
+    const primaryKey = await service.updateOne(req.params['pk'], req.body);
     try {
         const item = await service.readOne(primaryKey, req.sanitizedQuery);
-        res.locals.payload = { data: item || null };
+        res.locals['payload'] = { data: item || null };
     }
     catch (error) {
         if (error instanceof exceptions_1.ForbiddenException) {
@@ -126,7 +128,8 @@ router.delete('/', (0, async_handler_1.default)(async (req, res, next) => {
         await service.deleteMany(req.body.keys);
     }
     else {
-        await service.deleteByQuery(req.body.query);
+        const sanitizedQuery = (0, sanitize_query_1.sanitizeQuery)(req.body.query, req.accountability);
+        await service.deleteByQuery(sanitizedQuery);
     }
     return next();
 }), respond_1.respond);
@@ -135,7 +138,7 @@ router.delete('/:pk', (0, async_handler_1.default)(async (req, res, next) => {
         accountability: req.accountability,
         schema: req.schema,
     });
-    await service.deleteOne(req.params.pk);
+    await service.deleteOne(req.params['pk']);
     return next();
 }), respond_1.respond);
 exports.default = router;