public/photoview
1
0
Fork 0
mirror of https://git.vectorsigma.ru/public/photoview.git synced 2026-08-03 21:09:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix security bug regarding search

Browse Source 
...that let users search for albums and photos made by other users
This commit is contained in:
viktorstrate
2020-03-05 20:46:50 +01:00
parent 225f22bcfe
commit a5fc15af45
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
api/graphql/resolvers/search.go
View File

@@ -29,7 +29,7 @@ func (r *Resolver) Search(ctx context.Context, query string, _limitPhotos *int,
photoRows, err := r.Database.Query(` photoRows, err := r.Database.Query(`
SELECT photo.* FROM photo JOIN album ON photo.album_id = album.album_id SELECT photo.* FROM photo JOIN album ON photo.album_id = album.album_id
WHERE album.owner_id = ? AND photo.title LIKE ? OR photo.path LIKE ? WHERE album.owner_id = ? AND ( photo.title LIKE ? OR photo.path LIKE ? )
ORDER BY ( ORDER BY (
case when photo.title LIKE ? then 2 case when photo.title LIKE ? then 2
when photo.path LIKE ? then 1 when photo.path LIKE ? then 1
@@ -48,7 +48,7 @@ func (r *Resolver) Search(ctx context.Context, query string, _limitPhotos *int,
albumRows, err := r.Database.Query(` albumRows, err := r.Database.Query(`
SELECT * FROM album SELECT * FROM album
WHERE owner_id = ? AND title LIKE ? OR path LIKE ? WHERE owner_id = ? AND ( title LIKE ? OR path LIKE ? )
ORDER BY ( ORDER BY (
case when title LIKE ? then 2 case when title LIKE ? then 2
when path LIKE ? then 1 when path LIKE ? then 1