fastadmin 0.5.0__tar.gz → 0.6.0__tar.gz

{fastadmin-0.5.0 → fastadmin-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastadmin
-Version: 0.5.0
+Version: 0.6.0
 Summary: FastAdmin is an easy-to-use Admin Dashboard App for FastAPI/Flask/Django inspired by Django Admin.
 Keywords: admin,dashboard,fastapi,flask,django,tortoise-orm,sqlalchemy,pony,admin-dashboard,django-admin
 Author: Seva D

{fastadmin-0.5.0 → fastadmin-0.6.0}/fastadmin/api/frameworks/django/app/api.py

@@ -78,7 +78,13 @@ async def sign_in(request: HttpRequest) -> JsonResponse:
         )
 
         response = JsonResponse({})
-        response.set_cookie(settings.ADMIN_SESSION_ID_KEY, value=session_id, httponly=True)
+        response.set_cookie(
+            settings.ADMIN_SESSION_ID_KEY,
+            value=session_id,
+            httponly=True,
+            secure=settings.ADMIN_SESSION_COOKIE_SECURE,
+            samesite=settings.ADMIN_SESSION_COOKIE_SAMESITE.capitalize(),
+        )
         return response
 
     except AdminApiException as e:

{fastadmin-0.5.0 → fastadmin-0.6.0}/fastadmin/api/frameworks/fastapi/api.py

@@ -49,7 +49,13 @@ async def sign_in(
             request=request,
         )
 
-        response.set_cookie(settings.ADMIN_SESSION_ID_KEY, value=session_id, httponly=True)
+        response.set_cookie(
+            settings.ADMIN_SESSION_ID_KEY,
+            value=session_id,
+            httponly=True,
+            secure=settings.ADMIN_SESSION_COOKIE_SECURE,
+            samesite=settings.ADMIN_SESSION_COOKIE_SAMESITE,  # ty: ignore[invalid-argument-type]
+        )
     except AdminApiException as e:
         raise HTTPException(e.status_code, detail=e.detail) from None
 

{fastadmin-0.5.0 → fastadmin-0.6.0}/fastadmin/api/frameworks/fastapi/app.py

@@ -25,7 +25,9 @@ app.include_router(views_router)
 
 @app.exception_handler(Exception)
 async def exception_handler(_: Request, exc: Exception):
+    # Log the real error server-side but never leak internals to the client.
+    logger.error("Unhandled admin error: %s", exc)
     return JSONResponse(
         status_code=500,
-        content={"exception": str(exc)},
+        content={"exception": "Internal server error."},
     )

{fastadmin-0.5.0 → fastadmin-0.6.0}/fastadmin/api/frameworks/flask/api.py

@@ -42,7 +42,13 @@ async def sign_in() -> Response:
             request=request,
         )
         response = make_response({})
-        response.set_cookie(settings.ADMIN_SESSION_ID_KEY, value=session_id, httponly=True)
+        response.set_cookie(
+            settings.ADMIN_SESSION_ID_KEY,
+            value=session_id,
+            httponly=True,
+            secure=settings.ADMIN_SESSION_COOKIE_SECURE,
+            samesite=settings.ADMIN_SESSION_COOKIE_SAMESITE.capitalize(),
+        )
         return response
     except AdminApiException as e:
         http_exception = HTTPException(e.detail)

{fastadmin-0.5.0 → fastadmin-0.6.0}/fastadmin/api/helpers.py

@@ -84,15 +84,8 @@ def is_valid_id(id: UUID | int | str) -> bool:
     :return: True if id is a valid id, False otherwise.
     """
     if isinstance(id, str):
-        if not id:
-            return False
-        if is_valid_uuid(id):
-            return True
-        try:
-            int(id)
-            return True
-        except ValueError:
-            return True  # string PK (e.g. non-numeric)
+        # Any non-empty string is a valid PK (UUID, numeric, or opaque string PK).
+        return bool(id)
     if is_valid_uuid(str(id)):
         return True
     try:

{fastadmin-0.5.0 → fastadmin-0.6.0}/fastadmin/api/service.py

@@ -75,13 +75,47 @@ async def get_user_id_from_session_id(session_id: str | None) -> UUID | int | No
     if not user_id:
         return None
 
-    if not user_id or not await admin_model.get_obj(user_id):
+    if not await admin_model.get_obj(user_id):
         return None
 
     return user_id
 
 
+# Filter lookups a request may use. Anything else (e.g. regex, startswith, or a
+# relation-spanning "groups__name__icontains") is rejected so it cannot become a
+# side-channel oracle over columns the admin never displays.
+ALLOWED_FILTER_CONDITIONS = frozenset({"exact", "in", "lt", "lte", "gt", "gte", "contains", "icontains"})
+
+
 class ApiService:
+    @staticmethod
+    def _clamp_query_limits(query_params: ListQuerySchema) -> None:
+        """Bound offset/limit so a crafted request cannot dump/DoS a table."""
+        if query_params.offset is None or query_params.offset < 0:
+            query_params.offset = 0
+        max_limit = settings.ADMIN_QUERY_MAX_LIMIT
+        if query_params.limit is None or query_params.limit < 0 or query_params.limit > max_limit:
+            query_params.limit = max_limit
+
+    @staticmethod
+    def _validate_filters(admin_model: Any, filters: dict, exclude_filter_fields: tuple, fields: set) -> None:
+        """Validate filter keys against an allowlist and permitted lookups.
+
+        The filterable field set is ``list_filter`` when the admin defines it,
+        otherwise the serialized field set; the lookup suffix must be one of
+        ALLOWED_FILTER_CONDITIONS.
+        """
+        list_filter = getattr(admin_model, "list_filter", ())
+        allowlist = set(list_filter) if list_filter else fields
+        for k in filters:
+            if k in exclude_filter_fields:
+                continue
+            field, _, condition = k.partition("__")
+            if condition and condition not in ALLOWED_FILTER_CONDITIONS:
+                raise AdminApiException(422, detail=f"Filter by {k} is not allowed")
+            if field not in allowlist:
+                raise AdminApiException(422, detail=f"Filter by {k} is not allowed")
+
     @staticmethod
     def _bind_admin_context(
         admin_model: ModelAdmin | InlineModelAdmin | Any, request: Any | None, user: Any | None
@@ -102,6 +136,19 @@ class ApiService:
         )
         return current_user_id, current_user
 
+    @staticmethod
+    async def _require_permission(admin_model: Any, permission: str, user_id: UUID | int | None) -> None:
+        """Enforce a model-admin permission hook server-side.
+
+        The has_*_permission hooks gate the UI, but every mutating endpoint must
+        also enforce them so a crafted request cannot bypass a disabled action.
+        """
+        check = getattr(admin_model, permission, None)
+        if check is None:
+            return
+        if not await check(user_id=user_id):
+            raise AdminApiException(403, detail="You do not have permission to perform this action.")
+
     async def sign_in(
         self,
         session_id: str | None,
@@ -167,6 +214,7 @@ class ApiService:
             offset=offset,
             limit=limit,
         )
+        self._clamp_query_limits(query_params)
 
         admin_model = get_admin_or_admin_inline_model(model)
         if not admin_model:
@@ -184,12 +232,7 @@ class ApiService:
         exclude_filter_fields = ("search", "sort_by", "offset", "limit")
         query_filters: dict[tuple[str, str], bool | str | None | list] | None = None
         if query_params.filters:
-            for k in query_params.filters:
-                if k in exclude_filter_fields:
-                    continue
-                field = k.split("__", 1)[0]
-                if field not in fields:
-                    raise AdminApiException(422, detail=f"Filter by {k} is not allowed")
+            self._validate_filters(admin_model, query_params.filters, exclude_filter_fields, fields)
             query_filters = {
                 sanitize_filter_key(k, admin_model.get_model_fields_with_widget_types()): sanitize_filter_value(v)
                 for k, v in query_params.filters.items()
@@ -235,7 +278,7 @@ class ApiService:
             obj = await admin_model.get_obj(id)
         except Exception as e:
             logger.error("Error getting %s %s: %s", model, id, e)
-            raise AdminApiException(500, detail=f"Error getting {model} {id}: {e}") from e
+            raise AdminApiException(500, detail=f"Error getting {model}.") from e
         if not obj:
             raise AdminApiException(404, detail=f"{model} not found.")
         return obj
@@ -247,17 +290,20 @@ class ApiService:
         payload: dict,
         request: Any | None = None,
     ) -> dict:
-        _current_user_id, current_user = await self._get_authenticated_user(session_id)
+        current_user_id, current_user = await self._get_authenticated_user(session_id)
 
         admin_model = get_admin_or_admin_inline_model(model)
         if not admin_model:
             raise AdminApiException(404, detail=f"{model} model is not registered.")
         self._bind_admin_context(admin_model, request=request, user=current_user)
+        await self._require_permission(admin_model, "has_add_permission", current_user_id)
         try:
             return await admin_model.save_model(None, payload)  # ty: ignore[invalid-return-type]
+        except AdminApiException:
+            raise
         except Exception as e:
             logger.error("Error adding %s: %s", model, e)
-            raise AdminApiException(500, detail=f"Error adding {model}: {e}") from e
+            raise AdminApiException(500, detail=f"Error adding {model}.") from e
 
     async def change_password(
         self,
@@ -266,13 +312,19 @@ class ApiService:
         payload: dict,
         request: Any | None = None,
     ) -> None:
-        _current_user_id, current_user = await self._get_authenticated_user(session_id)
+        current_user_id, current_user = await self._get_authenticated_user(session_id)
 
         admin_model = get_admin_model(settings.ADMIN_USER_MODEL)
         if not admin_model:
             raise AdminApiException(404, detail=f"{settings.ADMIN_USER_MODEL} model is not registered.")
         self._bind_admin_context(admin_model, request=request, user=current_user)
 
+        # Users may change their own password; changing anyone else's requires the
+        # user-model change permission. Without this a signed-in user could reset a
+        # superuser's password (account takeover).
+        if str(id) != str(current_user_id):
+            await self._require_permission(admin_model, "has_change_permission", current_user_id)
+
         payload = ChangePasswordInputSchema(**payload)
         if payload.password != payload.confirm_password:
             raise AdminApiException(422, detail="Passwords do not match")
@@ -285,7 +337,8 @@ class ApiService:
         try:
             user = await admin_model.get_obj(id)
         except Exception as e:
-            raise AdminApiException(500, detail=f"Error getting {settings.ADMIN_USER_MODEL} {id}: {e}") from e
+            logger.error("Error getting %s %s: %s", settings.ADMIN_USER_MODEL, id, e)
+            raise AdminApiException(500, detail=f"Error getting {settings.ADMIN_USER_MODEL}.") from e
         if not user:
             raise AdminApiException(404, detail=f"{settings.ADMIN_USER_MODEL} not found.")
 
@@ -306,18 +359,21 @@ class ApiService:
         payload: dict,
         request: Any | None = None,
     ) -> dict:
-        _current_user_id, current_user = await self._get_authenticated_user(session_id)
+        current_user_id, current_user = await self._get_authenticated_user(session_id)
 
         admin_model = get_admin_or_admin_inline_model(model)
         if not admin_model:
             raise AdminApiException(404, detail=f"{model} model is not registered.")
         self._bind_admin_context(admin_model, request=request, user=current_user)
+        await self._require_permission(admin_model, "has_change_permission", current_user_id)
 
         try:
             obj = await admin_model.save_model(id, payload)
+        except AdminApiException:
+            raise
         except Exception as e:
             logger.error("Error changing %s %s: %s", model, id, e)
-            raise AdminApiException(500, detail=f"Error changing {model} {id}: {e}") from e
+            raise AdminApiException(500, detail=f"Error changing {model}.") from e
         if not obj:
             raise AdminApiException(404, detail=f"{model} not found.")
         return obj
@@ -358,7 +414,8 @@ class ApiService:
         except AdminApiException:
             raise
         except Exception as e:
-            raise AdminApiException(500, detail=f"Error uploading file for {model}: {e}") from e
+            logger.error("Error uploading file for %s: %s", model, e)
+            raise AdminApiException(500, detail=f"Error uploading file for {model}.") from e
 
     async def export(
         self,
@@ -370,7 +427,7 @@ class ApiService:
         filters: dict | None = None,
         request: Any | None = None,
     ) -> tuple[str, str, StringIO | BytesIO | None]:
-        _current_user_id, current_user = await self._get_authenticated_user(session_id)
+        current_user_id, current_user = await self._get_authenticated_user(session_id)
 
         query_params = ListQuerySchema(
             search=search,
@@ -379,11 +436,13 @@ class ApiService:
             offset=payload.offset,
             limit=payload.limit,
         )
+        self._clamp_query_limits(query_params)
 
         admin_model = get_admin_or_admin_inline_model(model)
         if not admin_model:
             raise AdminApiException(404, detail=f"{model} model is not registered.")
         self._bind_admin_context(admin_model, request=request, user=current_user)
+        await self._require_permission(admin_model, "has_export_permission", current_user_id)
 
         # validations
         fields = set(admin_model.get_fields_for_serialize())
@@ -396,12 +455,7 @@ class ApiService:
         exclude_filter_fields = ("search", "sort_by", "offset", "limit")
         query_filters: dict[tuple[str, str], bool | str | None | list] | None = None
         if query_params.filters:
-            for k in query_params.filters:
-                if k in exclude_filter_fields:
-                    continue
-                field = k.split("__", 1)[0]
-                if field not in fields:
-                    raise AdminApiException(422, detail=f"Filter by {k} is not allowed")
+            self._validate_filters(admin_model, query_params.filters, exclude_filter_fields, fields)
             query_filters = {
                 sanitize_filter_key(k, admin_model.get_model_fields_with_widget_types()): sanitize_filter_value(v)
                 for k, v in query_params.filters.items()
@@ -450,6 +504,7 @@ class ApiService:
         if not admin_model:
             raise AdminApiException(404, detail=f"{model} model is not registered.")
         self._bind_admin_context(admin_model, request=request, user=current_user)
+        await self._require_permission(admin_model, "has_delete_permission", current_user_id)
 
         if str(current_user_id) == str(id) and model == settings.ADMIN_USER_MODEL:
             raise AdminApiException(403, detail="You cannot delete yourself.")
@@ -457,7 +512,7 @@ class ApiService:
             await admin_model.delete_model(id)
         except Exception as e:
             logger.error("Error deleting %s %s: %s", model, id, e)
-            raise AdminApiException(500, detail=f"Error deleting {model} {id}: {e}") from e
+            raise AdminApiException(500, detail=f"Error deleting {model}.") from e
         return id
 
     async def action(

{fastadmin-0.5.0 → fastadmin-0.6.0}/fastadmin/models/base.py

@@ -16,6 +16,21 @@ from fastadmin.models.schemas import ModelFieldWidgetSchema, WidgetType
 
 Model = Any
 
+# Leading characters a spreadsheet interprets as the start of a formula.
+_CSV_FORMULA_PREFIXES = ("=", "+", "-", "@", "\t", "\r")
+
+
+def _neutralize_csv_value(value: Any) -> Any:
+    """Prevent CSV formula injection in exported data.
+
+    A cell like ``=HYPERLINK(...)`` or ``=cmd|...`` is executed by Excel/Sheets
+    when the export is opened. Prefix any string starting with a formula trigger
+    with a single quote so it is treated as text; non-strings pass through.
+    """
+    if isinstance(value, str) and value and value[0] in _CSV_FORMULA_PREFIXES:
+        return "'" + value
+    return value
+
 
 class BaseModelAdmin:
     """Base class for model admin"""
@@ -358,6 +373,24 @@ class BaseModelAdmin:
             fields_for_serialize |= set(self.list_display)
         return fields_for_serialize
 
+    def get_writable_field_names(self) -> set[str]:
+        """Model field names the admin form is allowed to write.
+
+        Enforced server-side in :meth:`save_model` so a crafted payload cannot
+        set fields hidden by ``fields``/``exclude`` or marked ``readonly_fields``
+        (e.g. ``is_superuser``). ``list_display``-only computed columns are not
+        included since they are not real model fields.
+
+        :return: A set of writable model field names.
+        """
+        writable = {field.name for field in self.get_model_fields_with_widget_types()}
+        if self.fields:
+            writable &= set(self.fields)
+        if self.exclude:
+            writable -= set(self.exclude)
+        writable -= set(self.readonly_fields)
+        return writable
+
     def resolve_sort_by(self, sort_by: str) -> str:
         """Resolve sort_by to the actual ORM ordering expression.
 
@@ -523,18 +556,19 @@ class BaseModelAdmin:
         """
         fields = self.get_model_fields_with_widget_types(with_m2m=False)
         m2m_fields = self.get_model_fields_with_widget_types(with_m2m=True)
+        writable = self.get_writable_field_names()
 
         fields_payload = {
             field.column_name: self.deserialize_value(field, payload[field.name])
             for field in fields
-            if field.name in payload
+            if field.name in payload and field.name in writable
         }
         obj = await self.orm_save_obj(id, fields_payload)
         if not obj:
             return None
 
         for m2m_field in m2m_fields:
-            if m2m_field.name in payload:
+            if m2m_field.name in payload and m2m_field.name in writable:
                 await self.orm_save_m2m_ids(obj, m2m_field.column_name, payload[m2m_field.name])
 
         return await self._serialize_obj_after_save(obj)
@@ -630,7 +664,7 @@ class BaseModelAdmin:
                 writer.writeheader()
                 for obj in objs:
                     obj_dict = await self.serialize_obj(obj, list_view=True)
-                    obj_dict = {k: v for k, v in obj_dict.items() if k in export_fields}
+                    obj_dict = {k: _neutralize_csv_value(v) for k, v in obj_dict.items() if k in export_fields}
                     writer.writerow(obj_dict)
                 output.seek(0)
                 return output
@@ -643,8 +677,13 @@ class BaseModelAdmin:
                         except TypeError:
                             return str(o)
 
+                # Emit the same column set as CSV so the two formats are consistent.
+                rows = []
+                for obj in objs:
+                    obj_dict = await self.serialize_obj(obj, list_view=True)
+                    rows.append({k: v for k, v in obj_dict.items() if k in export_fields})
                 output = StringIO()
-                json.dump([await self.serialize_obj(obj, list_view=True) for obj in objs], output, cls=JSONEncoder)
+                json.dump(rows, output, cls=JSONEncoder)
                 output.seek(0)
                 return output
             case _:
@@ -761,8 +800,10 @@ class ModelAdmin(BaseModelAdmin):
         obj = await super().save_model(id, payload)
         fields = self.get_model_fields_with_widget_types(with_m2m=False)
         password_fields = [field.name for field in fields if field.form_widget_type == WidgetType.PasswordInput]
-        if obj and id is None and password_fields:
-            # save hashed password for create
+        if obj and password_fields:
+            # Hash the submitted password via change_password on both create and
+            # edit. On edit the raw value was written by the base save_model, so
+            # hashing here overwrites it — the column never keeps a plaintext value.
             pk_name = self.get_model_pk_name(self.model_cls)
             pk = obj[pk_name]
             password_values = [payload[field] for field in password_fields if field in payload]

{fastadmin-0.5.0 → fastadmin-0.6.0}/fastadmin/models/orms/ponyorm.py

@@ -12,6 +12,32 @@ from fastadmin.models.schemas import ModelFieldWidgetSchema, WidgetType
 from fastadmin.settings import settings
 
 
+def _pony_filter_expr(condition: str, field: str) -> str:
+    """Build a Pony filter string that references the value via the local `fval`.
+
+    The caller binds ``fval`` (and ``fval.lower()`` for icontains) as a local so
+    Pony resolves it as a query parameter. ``field`` is a validated/allowlisted
+    path, so interpolating it is safe; the user value is never interpolated.
+    """
+    match condition:
+        case "in":
+            return f"m.{field} in fval"
+        case "lte":
+            return f"m.{field} <= fval"
+        case "gte":
+            return f"m.{field} >= fval"
+        case "lt":
+            return f"m.{field} < fval"
+        case "gt":
+            return f"m.{field} > fval"
+        case "contains":
+            return f"fval in m.{field}"
+        case "icontains":
+            return f"fval.lower() in m.{field}.lower()"
+        case _:  # exact
+            return f"m.{field} == fval"
+
+
 class PonyORMMixin:
     @staticmethod
     def get_model_pk_name(orm_model_cls: Any) -> str:
@@ -235,42 +261,25 @@ class PonyORMMixin:
                 model_pk_name = self.get_model_pk_name(self.model_cls)
                 if field.endswith(f"_{model_pk_name}"):
                     field = field.replace(f"_{model_pk_name}", f".{model_pk_name}")
-                if condition == "in":
-                    value_set = set(value)
-                    qs = qs.filter(
-                        lambda m, f=field, vs=value_set: getattr(m, f) in vs,
-                    )
-                    continue
-                pony_condition = "=="
-                match condition:
-                    case "lte":
-                        pony_condition = ">="
-                    case "gte":
-                        pony_condition = "<="
-                    case "lt":
-                        pony_condition = ">"
-                    case "gt":
-                        pony_condition = "<"
-                    case "exact":
-                        pony_condition = "=="
-                    case "contains":
-                        pony_condition = "in"
-                    case "icontains":
-                        # Pony string filter: value.lower() in m.field.lower() for case-insensitive
-                        filter_expr = f'"{value.lower()}" in m.{field}.lower()'
-                        qs = qs.filter(filter_expr)
-                        continue
-                filter_expr = f""""{value}" {pony_condition}  m.{field}"""
-                qs = qs.filter(filter_expr)
+                # Bind the user-supplied value as a local (`fval`) so Pony
+                # resolves it as a query parameter. Only the field path — built
+                # from the admin's validated/allowlisted field names — is
+                # interpolated; the value is never placed into the filter string
+                # (Pony evaluates filter strings as Python expressions).
+                fval = set(value) if condition == "in" else value  # noqa: F841 (referenced by Pony filter string)
+                expr = _pony_filter_expr(condition, field)
+                qs = qs.filter(expr)
 
         search_fields = list(self.search_fields)
         if search and search_fields:
             ids = []
+            # Bind the user-supplied search term as a local so Pony resolves it
+            # as a parameter. Only the field path (from the admin's trusted
+            # search_fields config) is interpolated — never the search value.
+            search_term = search.lower()  # noqa: F841 (referenced by Pony filter string)
             for search_field in search_fields:
                 pony_search_field = search_field.replace("__", ".")
-                # Pony string filter for case-insensitive search
-                filter_expr = f'"{search.lower()}" in m.{pony_search_field}.lower()'
-                qs_ids = qs.filter(filter_expr)
+                qs_ids = qs.filter(f"search_term in m.{pony_search_field}.lower()")
                 objs = list(qs_ids)
                 ids += [o.id for o in objs]
             qs = qs.filter(lambda m: m.id in set(ids))

{fastadmin-0.5.0 → fastadmin-0.6.0}/fastadmin/models/orms/sqlalchemy.py

@@ -2,7 +2,7 @@ import contextlib
 from typing import Any
 from uuid import UUID
 
-from sqlalchemy import BIGINT, Integer, and_, func, inspect, or_, select, text
+from sqlalchemy import BIGINT, Integer, and_, func, inspect, or_, select
 from sqlalchemy.orm import selectinload
 
 from fastadmin.models.base import InlineModelAdmin, ModelAdmin
@@ -11,6 +11,18 @@ from fastadmin.models.schemas import ModelFieldWidgetSchema, WidgetType
 from fastadmin.settings import settings
 
 
+def _escape_like(value: Any) -> Any:
+    """Escape LIKE/ILIKE wildcards so user input matches literally.
+
+    Without this, ``%`` and ``_`` in a filter/search value act as wildcards
+    (matching anything / any single char), letting a caller widen a match or
+    force an expensive scan. Used with ``escape="\\"`` on the like/ilike call.
+    """
+    if not isinstance(value, str):
+        return value
+    return value.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")
+
+
 class SqlAlchemyMixin:
     def _build_search_condition(self, field_path: str, search: str) -> Any | None:
         """Build SQLAlchemy search condition for simple and nested fields.
@@ -25,7 +37,7 @@ class SqlAlchemyMixin:
                 return None
 
             if len(parts) == 1:
-                return attr.ilike(f"%{search}%")
+                return attr.ilike(f"%{_escape_like(search)}%", escape="\\")
 
             rel_property = getattr(attr, "property", None)
             if rel_property is None:
@@ -303,11 +315,15 @@ class SqlAlchemyMixin:
         :return: A tuple of list of objects and total count.
         """
 
-        def convert_sort_by(sort_by: str) -> str:
-            sort_by = self._resolve_ordering_field(sort_by)
-            if sort_by.startswith("-"):
-                return sort_by[1:] + " desc"
-            return sort_by
+        def order_column(ordering_field: str):
+            # Build an ordering expression from a real Column instead of raw
+            # text() SQL, so a sort key can never reach the SQL string.
+            resolved = self._resolve_ordering_field(ordering_field)
+            descending = resolved.startswith("-")
+            column = getattr(self.model_cls, resolved.lstrip("-"), None)
+            if column is None:
+                return None
+            return column.desc() if descending else column.asc()
 
         sessionmaker = self.get_sessionmaker()
         async with sessionmaker() as session:
@@ -340,9 +356,9 @@ class SqlAlchemyMixin:
                                     value = [int(x) for x in value]  # ty: ignore[not-iterable]
                             q.append(model_field.in_(value))
                         case "contains":
-                            q.append(model_field.like(f"%{value}%"))
+                            q.append(model_field.like(f"%{_escape_like(value)}%", escape="\\"))
                         case "icontains":
-                            q.append(model_field.ilike(f"%{value}%"))
+                            q.append(model_field.ilike(f"%{_escape_like(value)}%", escape="\\"))
                 qs = qs.where(and_(*q))
 
             search_fields = list(self.search_fields)
@@ -356,11 +372,15 @@ class SqlAlchemyMixin:
                     return [], 0
                 qs = qs.where(or_(*q))
 
+            order_columns = []
             if sort_by:
-                qs = qs.order_by(text(convert_sort_by(sort_by)))
+                column = order_column(sort_by)
+                if column is not None:
+                    order_columns.append(column)
             elif self.ordering:
-                sort_by_text = ", ".join([convert_sort_by(f) for f in self.ordering])
-                qs = qs.order_by(text(sort_by_text))
+                order_columns = [c for c in (order_column(f) for f in self.ordering) if c is not None]
+            if order_columns:
+                qs = qs.order_by(*order_columns)
 
             count_stmt = select(func.count()).select_from(qs.subquery())
             total = (await session.execute(count_stmt)).scalar_one()

{fastadmin-0.5.0 → fastadmin-0.6.0}/fastadmin/settings.py

@@ -29,7 +29,19 @@ class Settings:
     ADMIN_SESSION_ID_KEY: str = os.getenv("ADMIN_SESSION_ID_KEY", "admin_session_id")
 
     # This value is the expired_at period (in sec) for session id.
-    ADMIN_SESSION_EXPIRED_AT: int = os.getenv("ADMIN_SESSION_EXPIRED_AT", 144000)  # in sec
+    ADMIN_SESSION_EXPIRED_AT: int = int(os.getenv("ADMIN_SESSION_EXPIRED_AT", 144000))  # in sec
+
+    # Set the Secure flag on the session cookie so it is only sent over HTTPS.
+    # Enabled by default; set ADMIN_SESSION_COOKIE_SECURE=false for local HTTP dev.
+    ADMIN_SESSION_COOKIE_SECURE: bool = os.getenv("ADMIN_SESSION_COOKIE_SECURE", "true").lower() != "false"
+
+    # SameSite policy for the session cookie ("lax", "strict" or "none").
+    # "lax" blocks the cross-site POST/PATCH/DELETE requests behind CSRF.
+    ADMIN_SESSION_COOKIE_SAMESITE: str = os.getenv("ADMIN_SESSION_COOKIE_SAMESITE", "lax")
+
+    # Hard upper bound on the number of rows a single list/export request may
+    # return. Caps memory/CPU use from a crafted limit=100000000 request.
+    ADMIN_QUERY_MAX_LIMIT: int = int(os.getenv("ADMIN_QUERY_MAX_LIMIT", 1000))
 
     # This value is the date format for JS widgets.
     ADMIN_DATE_FORMAT: str = os.getenv("ADMIN_DATE_FORMAT", "YYYY-MM-DD")