accept validateParams audits in filter #400
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tahini
requested changes
Mar 18, 2024
| @@ -376,11 +376,12 @@ const getRawWhereClause = ( | |||
| ): string | [string, string | boolean | number] | undefined => { | |||
| // Make sure the field is a legitimate field to avoid sql injection. Field | |||
| // is either the name of a field, or a dot-separated path in a json object | |||
| // of the 'responses' field. We should not accept anything else. | |||
| // of the 'responses' field, or an audit name for validateParams, | |||
| // which includes "-" and ":". We should not accept anything else. | |||
There was a problem hiding this comment.
If different fields have different regexes, we should not have only one regex here. Instead, we should make the match with - and : in the case of audits and with . in the case of responses. Otherwise, there may be eventual unexpected results
There was a problem hiding this comment.
added a check for field = audits
kaligrafy
force-pushed
the
acceptValidateParamsAuditsInFilter
branch
from
298aaf2 to
0672947
Compare
kaligrafy
force-pushed
the
acceptValidateParamsAuditsInFilter
branch
from
0672947 to
a003f63
Compare
greenscientist
pushed a commit
to greenscientist/evolution
that referenced
this pull request
Apr 29, 2024
* This lets one force input to be lowercase, uppercase, etc. * This is necessary in order to force postal code to be uppercase, as specified in od_mtl_2023 issue chairemobilite#400 (chairemobilite/od_mtl_2023#400) * This only changes how the text is displayed on the web page. It does not change the text that is sent to the backend. * Modify an InputString unit test to consider the new `textTransform` property * Add an example usage of textTransform to the postal code widget in the demo survey
|
@kaligrafy , @tahini what is going on here? |
|
Je ne comprends pas le lien entre le code et le commit message. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.