starred/1Panel
1
0
Fork 0
mirror of https://github.com/1Panel-dev/1Panel.git synced 2026-09-28 00:01:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: 解决潜在的 SQL 注入漏洞 (#5906)

Browse Source 
影响范围：操作日志
This commit is contained in:
zhengkunwang
2024-07-22 14:41:31 +00:00
committed by GitHub
parent 68922676fc
commit 3339ba9bad
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/middleware/operation.go
+2 -3
View File
@@ -96,10 +96,9 @@ func OperationLog() gin.HandlerFunc {
if funcs.InputValue == key {
var names []string
if funcs.IsList {
sql := fmt.Sprintf("SELECT %s FROM %s where %s in (?);", funcs.OutputColumn, funcs.DB, funcs.InputColumn)
_ = global.DB.Raw(sql, value).Scan(&names)
_ = global.DB.Raw("select ? from ? where ? in (?);", funcs.OutputColumn, funcs.DB, funcs.InputColumn, value).Scan(&names)
} else {
_ = global.DB.Raw(fmt.Sprintf("select %s from %s where %s = ?;", funcs.OutputColumn, funcs.DB, funcs.InputColumn), value).Scan(&names)
_ = global.DB.Raw("select ? from ? where ? = ?;", funcs.OutputColumn, funcs.DB, funcs.InputColumn, value).Scan(&names)
}
formatMap[funcs.OutputValue] = strings.Join(names, ",")
break