spice-js 2.6.60 → 2.6.62

package/build/utility/RestHelper.js

@@ -74,6 +74,7 @@ class RestHelper {
 
       try {
         var download_type = ctx.request.query.format || "csv";
+        var include_id = ctx.request.query.include_id;
         var content;
 
         if (download_type == "csv") {
@@ -82,6 +83,10 @@ class RestHelper {
           } = yield Promise.resolve().then(() => _interopRequireWildcard(require("flat")));
 
           var items = _lodash.default.map(ctx.data, item => {
+            if (!include_id || include_id == "false") {
+              delete item.id;
+            }
+
             delete item._permissions_;
             return flatten(item);
           });

package/build/utility/Security.js

@@ -22,7 +22,7 @@ function hasSQLInjection(input) {
   "exec(", // Execution function in T-SQL
   "execute(", // Another execution function in T-SQL
   "xp_", // Extended stored procedures in T-SQL - often used in older SQL Server attacks
-  "0x", // Hex encoding
+  "0x ", // Hex encoding
   "benchmark(", // MySQL benchmark function - can be used for time-based blind attacks
   "sleep(", // MySQL sleep function - can also be used for time-based blind attacks
   "pg_sleep(", // PostgreSQL sleep function - time-based blind attack

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spice-js",
-  "version": "2.6.60",
+  "version": "2.6.62",
   "description": "spice",
   "main": "build/index.js",
   "repository": {

package/src/models/SpiceModel.js

@@ -801,7 +801,7 @@ export default class SpiceModel {
       } else {
         delete results["id"];
         results.deleted = true;
-        delete_response = await this.database.update(args.id, "");
+        delete_response = await this.database.update(args.id, results);
       }
       if (args.skip_hooks != true) {
         await this.run_hook(results, "delete", "after", results);