Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
D
douban-api-proxy
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
captainwong
douban-api-proxy
Commits
c0b561cb
Commit
c0b561cb
authored
May 01, 2021
by
Ozzieisaacs
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Better input check for custom_columns
parent
bd3ccfd0
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
27 additions
and
1 deletion
+27
-1
admin.py
cps/admin.py
+27
-1
No files found.
cps/admin.py
View file @
c0b561cb
...
@@ -473,6 +473,21 @@ def update_table_settings():
...
@@ -473,6 +473,21 @@ def update_table_settings():
return
"Invalid request"
,
400
return
"Invalid request"
,
400
return
""
return
""
def
check_valid_read_column
(
column
):
if
column
is
not
"0"
:
if
not
calibre_db
.
session
.
query
(
db
.
Custom_Columns
)
.
filter
(
db
.
Custom_Columns
.
id
==
column
)
\
.
filter
(
and_
(
db
.
Custom_Columns
.
datatype
==
'bool'
,
db
.
Custom_Columns
.
mark_for_delete
==
0
))
.
all
():
return
False
return
True
def
check_valid_restricted_column
(
column
):
if
column
is
not
"0"
:
if
not
calibre_db
.
session
.
query
(
db
.
Custom_Columns
)
.
filter
(
db
.
Custom_Columns
.
id
==
column
)
\
.
filter
(
and_
(
db
.
Custom_Columns
.
datatype
==
'text'
,
db
.
Custom_Columns
.
mark_for_delete
==
0
))
.
all
():
return
False
return
True
@
admi
.
route
(
"/admin/viewconfig"
,
methods
=
[
"POST"
])
@
admi
.
route
(
"/admin/viewconfig"
,
methods
=
[
"POST"
])
@
login_required
@
login_required
...
@@ -488,12 +503,23 @@ def update_view_configuration():
...
@@ -488,12 +503,23 @@ def update_view_configuration():
if
_config_string
(
"config_title_regex"
):
if
_config_string
(
"config_title_regex"
):
calibre_db
.
update_title_sort
(
config
)
calibre_db
.
update_title_sort
(
config
)
if
not
check_valid_read_column
(
to_save
.
get
(
"config_read_column"
,
"0"
)):
flash
(
_
(
u"Invalid Read Column"
),
category
=
"error"
)
log
.
debug
(
"Invalid Read column"
)
return
view_configuration
()
_config_int
(
"config_read_column"
)
_config_int
(
"config_read_column"
)
if
not
check_valid_restricted_column
(
to_save
.
get
(
"config_restricted_column"
,
"0"
)):
flash
(
_
(
u"Invalid Restricted Column"
),
category
=
"error"
)
log
.
debug
(
"Invalid Restricted Column"
)
return
view_configuration
()
_config_int
(
"config_restricted_column"
)
_config_int
(
"config_theme"
)
_config_int
(
"config_theme"
)
_config_int
(
"config_random_books"
)
_config_int
(
"config_random_books"
)
_config_int
(
"config_books_per_page"
)
_config_int
(
"config_books_per_page"
)
_config_int
(
"config_authors_max"
)
_config_int
(
"config_authors_max"
)
_config_int
(
"config_restricted_column"
)
config
.
config_default_role
=
constants
.
selected_roles
(
to_save
)
config
.
config_default_role
=
constants
.
selected_roles
(
to_save
)
config
.
config_default_role
&=
~
constants
.
ROLE_ANONYMOUS
config
.
config_default_role
&=
~
constants
.
ROLE_ANONYMOUS
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment