]> git.ipfire.org Git - thirdparty/patchwork.git/commit
projects / thirdparty / patchwork.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 77ae422) | patch
views/user: string interpolation in raw SQL is safe here
authorDaniel Axtens <dja@axtens.net>
Mon, 29 Jan 2018 15:37:51 +0000 (02:37 +1100)
committerDaniel Axtens <dja@axtens.net>
Tue, 30 Jan 2018 15:35:35 +0000 (02:35 +1100)
commit846f825f2bc3f854ff359db46b8d78ee1dbfc2f8
tree58e5842fabec0e1b8f0ed2af60ede35a790623fdtree | snapshot
parent77ae4221d59a335ed17ec3e5dde9382a3ba7b7fbcommit | diff
views/user: string interpolation in raw SQL is safe here

There's a FIXME asking for some generated SQL that uses string
interpolation to be investigated.

I investigated.

It's safe - it only interpolates table/column names, not
user-controlled data.

Replace the FIXME with an explanatory statement.

Signed-off-by: Daniel Axtens <dja@axtens.net>
patchwork/views/user.py diff | blob | blame | history
Mirror of https://github.com/getpatchwork/patchwork.git