Appwrite/appwrite
1
0
Fork 0
mirror of https://github.com/appwrite/appwrite.git synced 2026-05-26 13:51:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

allowedAttributes

Browse Source
This commit is contained in:
fogelito
2026-01-11 16:22:19 +02:00
parent de572c3aa9
commit 900d8f248e
2 changed files with 26 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Appwrite/Utopia/Database/Validator/Queries/Base.php
+1 -1
View File
@@ -132,7 +132,7 @@ class Base extends Types
$context = new QueryContext();
$context->add($this->collection);
parent::__construct($this->types, $context);
parent::__construct($this->types, $context, $allowedAttributes);
}
public function isSelectQueryAllowed(): bool
src/Appwrite/Utopia/Database/Validator/Queries/Types.php
+25 -8
View File
@@ -28,17 +28,25 @@ class Types extends Validator
protected ?QueryContext $context = null;
/**
* @param array<string> $types
* @param string[] $allowedAttributes
*/
public function __construct(array $types = [], ?QueryContext $context = null)
protected array $allowedAttributes;
/**
* @param array $types
* @param QueryContext|null $context
* @param array $allowedAttributes
*/
public function __construct(array $types = [], ?QueryContext $context = null, array $allowedAttributes = [])
{
$this->types = $types;
if ($context === null) {
if (is_null($context)) {
$context = new QueryContext();
}
$this->context = $context;
$this->allowedAttributes = $allowedAttributes;
}
/**
@@ -69,11 +77,6 @@ class Types extends Validator
$query = Query::parse($query);
}
if (Query::isFilter($query->getMethod())) {
throw new \Exception('shmuel');
// Check only allowed attribtes!!
}
if ($query->isNested()) {
if (!self::isValid($query->getValues())) {
throw new \Exception('Invalid queries');
@@ -83,6 +86,20 @@ class Types extends Validator
if (!in_array($query->getMethod(), $this->types)) {
throw new \Exception("Query method {$query->getMethod()} not allowed");
}
/**
* Check only allowed attributed
*/
//if (Query::isFilter($query->getMethod())) {
if (
$query->getMethod() !== Query::TYPE_SELECT &&
!empty($query->getAttribute()) &&
!in_array($query->getAttribute(), $this->allowedAttributes)
) {
throw new \Exception('shmuel');
}
//}
}
$validator = new DocumentsValidator(