darkhelm/notifications-api
1
0
Fork 0
mirror of https://github.com/GSA/notifications-api.git synced 2026-09-11 10:28:55 -04:00
Code Issues Packages Projects Releases Wiki Activity

notify-api-91 sanitize SQL inputs against injection

Browse Source
This commit is contained in:
Kenneth Kehl
2023-07-14 09:07:23 -07:00
parent 4417838b09
commit e6077c187c
7 changed files with 61 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
migrations/versions/0391_update_sms_numbers.py
+8 -5
View File
@@ -19,13 +19,16 @@ NEW_SMS_NUMBER = current_app.config['NOTIFY_INTERNATIONAL_SMS_SENDER'].strip('+'
def upgrade():
op.alter_column("service_sms_senders", "sms_sender", type_=sa.types.String(length=255))
op.alter_column("inbound_numbers", "number", type_=sa.types.String(length=255))
op.execute(f"UPDATE service_sms_senders SET sms_sender = '+{NEW_SMS_NUMBER}' WHERE sms_sender IN ('{OLD_SMS_NUMBER}', '{NEW_SMS_NUMBER}')")
op.execute(f"UPDATE inbound_numbers SET number = '+{NEW_SMS_NUMBER}' WHERE number IN ('{OLD_SMS_NUMBER}', '{NEW_SMS_NUMBER}')")
op.execute("UPDATE service_sms_senders SET sms_sender = '+{}' "
"WHERE sms_sender IN ('{}', '{}')".format(NEW_SMS_NUMBER, OLD_SMS_NUMBER, NEW_SMS_NUMBER))
op.execute("UPDATE inbound_numbers SET number = '+{}' "
"WHERE number IN ('{}', '{}')".format(NEW_SMS_NUMBER, OLD_SMS_NUMBER, NEW_SMS_NUMBER))
def downgrade():
op.execute(f"UPDATE service_sms_senders SET sms_sender = '{OLD_SMS_NUMBER}' WHERE sms_sender = '+{NEW_SMS_NUMBER}'")
op.execute(f"UPDATE inbound_numbers SET number = '{OLD_SMS_NUMBER}' WHERE number = '+{NEW_SMS_NUMBER}'")
op.execute("UPDATE service_sms_senders SET sms_sender = '{}' "
"WHERE sms_sender = '+{}'".format(OLD_SMS_NUMBER, NEW_SMS_NUMBER))
op.execute("UPDATE inbound_numbers SET number = '{}' "
"WHERE number = '+{}'".format(OLD_SMS_NUMBER, NEW_SMS_NUMBER))
op.alter_column("service_sms_senders", "sms_sender", type_=sa.types.String(length=11))
op.alter_column("inbound_numbers", "number", type_=sa.types.String(length=11))