From a5fc15af45ee1cfe88935f4dd7b70f3a074ffb51 Mon Sep 17 00:00:00 2001 From: viktorstrate Date: Thu, 5 Mar 2020 20:46:50 +0100 Subject: [PATCH] Fix security bug regarding search ...that let users search for albums and photos made by other users --- api/graphql/resolvers/search.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/api/graphql/resolvers/search.go b/api/graphql/resolvers/search.go index a8b26ce5..b43a9b18 100644 --- a/api/graphql/resolvers/search.go +++ b/api/graphql/resolvers/search.go @@ -29,7 +29,7 @@ func (r *Resolver) Search(ctx context.Context, query string, _limitPhotos *int, photoRows, err := r.Database.Query(` SELECT photo.* FROM photo JOIN album ON photo.album_id = album.album_id - WHERE album.owner_id = ? AND photo.title LIKE ? OR photo.path LIKE ? + WHERE album.owner_id = ? AND ( photo.title LIKE ? OR photo.path LIKE ? ) ORDER BY ( case when photo.title LIKE ? then 2 when photo.path LIKE ? then 1 @@ -48,7 +48,7 @@ func (r *Resolver) Search(ctx context.Context, query string, _limitPhotos *int, albumRows, err := r.Database.Query(` SELECT * FROM album - WHERE owner_id = ? AND title LIKE ? OR path LIKE ? + WHERE owner_id = ? AND ( title LIKE ? OR path LIKE ? ) ORDER BY ( case when title LIKE ? then 2 when path LIKE ? then 1