amorfo77/sogo
1
0
Fork 0
mirror of https://github.com/inverse-inc/sogo.git synced 2026-08-16 20:33:19 +00:00
Code Issues Projects Releases Wiki Activity

fix(core): only escape "%" with the SQL LIKE operator

Browse Source
This commit is contained in:
Francis Lachapelle
2022-01-31 14:53:58 -05:00
parent 88b0b6a00b
commit 7c81e3acec
6 changed files with 24 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SoObjects/Appointments/SOGoAppointmentFolder.m
+6 -6
View File
@@ -1,5 +1,5 @@
/*
Copyright (C) 2007-2019 Inverse inc.
Copyright (C) 2007-2022 Inverse inc.
Copyright (C) 2004-2005 SKYRIX Software AG
This file is part of SOGo.
@@ -794,7 +794,7 @@ static Class iCalEventK = nil;
if ([title length])
[baseWhere
addObject: [NSString stringWithFormat: @"c_title isCaseInsensitiveLike: '%%%@%%'",
[title asSafeSQLString]]];
[title asSafeSQLLikeString]]];
if (component)
{
@@ -1577,14 +1577,14 @@ firstInstanceCalendarDateRange: (NGCalendarDateRange *) fir
if ([filters isEqualToString:@"title_Category_Location"] || [filters isEqualToString:@"entireContent"])
{
[baseWhere addObject: [NSString stringWithFormat: @"(c_title isCaseInsensitiveLike: '%%%@%%' OR c_category isCaseInsensitiveLike: '%%%@%%' OR c_location isCaseInsensitiveLike: '%%%@%%')",
[title asSafeSQLString],
[title asSafeSQLString],
[title asSafeSQLString]]];
[title asSafeSQLLikeString],
[title asSafeSQLLikeString],
[title asSafeSQLLikeString]]];
}
}
else
[baseWhere addObject: [NSString stringWithFormat: @"c_title isCaseInsensitiveLike: '%%%@%%'",
[title asSafeSQLString]]];
[title asSafeSQLLikeString]]];
}
/* prepare mandatory fields */
SoObjects/Contacts/SOGoContactGCSFolder.m
+3 -3
View File
@@ -1,5 +1,5 @@
/*
Copyright (C) 2006-2019 Inverse inc.
Copyright (C) 2006-2022 Inverse inc.
This file is part of SOGo.
@@ -208,7 +208,7 @@ static NSArray *folderListingFields = nil;
qualifier = nil;
if ([filter length] > 0)
{
filter = [filter asSafeSQLString];
filter = [filter asSafeSQLLikeString];
filters = [NSMutableArray array];
filterFormat = [NSString stringWithFormat: @"(%%@ isCaseInsensitiveLike: '%%%%%@%%%%')", filter];
if (criteria)
@@ -356,7 +356,7 @@ static NSArray *folderListingFields = nil;
if (aName && [aName length] > 0)
{
aName = [aName asSafeSQLString];
qs = [NSString stringWithFormat: @"(c_name='%@')", aName];
qs = [NSString stringWithFormat: @"(c_name = '%@')", aName];
qualifier = [EOQualifier qualifierWithQualifierFormat: qs];
dbRecords = [[self ocsFolder] fetchFields: folderListingFields
matchingQualifier: qualifier];
SoObjects/SOGo/NSString+Utilities.h
+2 -1
View File
@@ -1,6 +1,6 @@
/* NSString+Utilities.h - this file is part of SOGo
*
* Copyright (C) 2006-2019 Inverse inc.
* Copyright (C) 2006-2022 Inverse inc.
*
* This file is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -51,6 +51,7 @@
/* SQL safety */
- (NSString *) asSafeSQLString;
- (NSString *) asSafeSQLLikeString;
/* Unicode safety */
- (NSString *) safeString;
SoObjects/SOGo/NSString+Utilities.m
+8 -4
View File
@@ -1,6 +1,6 @@
/* NSString+Utilities.m - this file is part of SOGo
*
* Copyright (C) 2006-2019 Inverse inc.
* Copyright (C) 2006-2022 Inverse inc.
*
* This file is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -725,9 +725,13 @@ static int cssEscapingCount;
- (NSString *) asSafeSQLString
{
return [[[self stringByReplacingString: @"\\" withString: @"\\\\"]
stringByReplacingString: @"'" withString: @"\\'"]
stringByReplacingString: @"\%" withString: @"\\%"];
return [[self stringByReplacingString: @"\\" withString: @"\\\\"]
stringByReplacingString: @"'" withString: @"\\'"];
}
- (NSString *) asSafeSQLLikeString
{
return [[self asSafeSQLString] stringByReplacingString: @"\%" withString: @"\\%"];
}
- (NSUInteger) countOccurrencesOfString: (NSString *) substring
SoObjects/SOGo/SOGoGCSFolder.m
+4 -5
View File
@@ -1,7 +1,7 @@
/* SOGoGCSFolder.m - this file is part of SOGo
*
* Copyright (C) 2004-2005 SKYRIX Software AG
* Copyright (C) 2006-2014 Inverse inc.
* Copyright (C) 2006-2022 Inverse inc.
*
* This file is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -1969,8 +1969,8 @@ static NSArray *childRecordFields = nil;
if (sqlFilter)
{
filterString = [NSMutableString stringWithCapacity: 8192];
[filterString appendFormat: @"(c_name='%@')",
[cNames componentsJoinedByString: @"' OR c_name='"]];
[filterString appendFormat: @"(c_name = '%@')",
[cNames componentsJoinedByString: @"' OR c_name = '"]];
if ([sqlFilter length] > 0)
[filterString appendFormat: @" AND (%@)", sqlFilter];
qualifier = [EOQualifier qualifierWithQualifierFormat: filterString];
@@ -2012,8 +2012,7 @@ static NSArray *childRecordFields = nil;
{
currentName = [[cNames objectAtIndex: count] asSafeSQLString];
queryNameLength = idQueryOverhead + [currentName length];
if ((currentSize + queryNameLength)
> maxQuerySize)
if ((currentSize + queryNameLength) > maxQuerySize)
{
records = [self _fetchComponentsWithNames: currentNames fields: fields];
[components addObjectsFromArray: records];
SoObjects/SOGo/SQLSource.m
+1 -1
View File
@@ -861,7 +861,7 @@
if ([filter length])
{
lowerFilter = [filter lowercaseString];
lowerFilter = [lowerFilter asSafeSQLString];
lowerFilter = [lowerFilter asSafeSQLLikeString];
filterFormat = [NSString stringWithFormat: @"LOWER(%%@) LIKE '%%%%%@%%%%'", lowerFilter];
if (criteria)
criteriaList = [criteria objectEnumerator];