1Panel-dev/1Panel
1
1
Fork 0
mirror of https://github.com/1Panel-dev/1Panel.git synced 2024-11-10 17:13:30 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: 解决潜在的 SQL 注入漏洞 (#5906)
Some checks failed
Build Test / build-linux-binary (push) Failing after -6m53s
Details
Build / SonarCloud (push) Failing after -6m55s
Details
sync2gitee / repo-sync (push) Failing after -6m56s
Details

Browse source 
影响范围：操作日志
This commit is contained in:
zhengkunwang 2024-07-22 22:41:31 +08:00 committed by GitHub
parent 68922676fc
commit 3339ba9bad
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 2 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
backend/middleware/operation.go
View file

@ -96,10 +96,9 @@ func OperationLog() gin.HandlerFunc {
if funcs.InputValue == key { if funcs.InputValue == key {
var names []string var names []string
if funcs.IsList { if funcs.IsList {
sql := fmt.Sprintf("SELECT %s FROM %s where %s in (?);", funcs.OutputColumn, funcs.DB, funcs.InputColumn) _ = global.DB.Raw("select ? from ? where ? in (?);", funcs.OutputColumn, funcs.DB, funcs.InputColumn, value).Scan(&names)
_ = global.DB.Raw(sql, value).Scan(&names)
} else { } else {
_ = global.DB.Raw(fmt.Sprintf("select %s from %s where %s = ?;", funcs.OutputColumn, funcs.DB, funcs.InputColumn), value).Scan(&names) _ = global.DB.Raw("select ? from ? where ? = ?;", funcs.OutputColumn, funcs.DB, funcs.InputColumn, value).Scan(&names)
} }
formatMap[funcs.OutputValue] = strings.Join(names, ",") formatMap[funcs.OutputValue] = strings.Join(names, ",")
break break