darkhelm/notifications-api
1
0
Fork 0
mirror of https://github.com/GSA/notifications-api.git synced 2026-09-11 10:28:55 -04:00
Code Issues Packages Projects Releases Wiki Activity

notify-api-91 sanitize SQL inputs against injection

Browse Source
This commit is contained in:
Kenneth Kehl
2023-07-14 09:07:23 -07:00
parent 4417838b09
commit e6077c187c
7 changed files with 61 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
migrations/versions/0375_fix_service_name.py
+9 -8
View File
@@ -14,19 +14,20 @@ from flask import current_app
service_id = current_app.config['NOTIFY_SERVICE_ID']
def upgrade():
op.get_bind()
# modify name of default service user in services
table_name = 'services'
col = 'name'
val = 'US Notify'
select_by_col = 'id'
select_by_val = service_id
op.execute(f"update {table_name} set {col}='{val}' where {select_by_col} = '{select_by_val}'")
# table_name = 'services'
# col = 'name'
# val = 'US Notify'
# select_by_col = 'id'
# select_by_val = service_id
op.execute("update services set name='US Notify' where id = '{}'".format(service_id))
table_name = 'services_history'
op.execute(f"update {table_name} set {col}='{val}' where {select_by_col} = '{select_by_val}'")
# table_name = 'services_history'
op.execute("update services_history set name='US Notify' where id = '{}'".format(service_id))
def downgrade():