From b5948f2e715d25ff1221f139a232c8904dd6df6b Mon Sep 17 00:00:00 2001 From: Thomas Boerger Date: Sun, 27 Mar 2016 23:26:45 +0200 Subject: [PATCH] Made the issues query more secure and simpler --- models/issue.go | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-) diff --git a/models/issue.go b/models/issue.go index 5727e07b11..f70fd1247b 100644 --- a/models/issue.go +++ b/models/issue.go @@ -547,27 +547,16 @@ func Issues(opts *IssuesOptions) ([]*Issue, error) { } labelIDs := base.StringsToInt64s(strings.Split(opts.Labels, ",")) - if len(labelIDs) > 0 { - validJoin := false - queryStr := "issue.id=issue_label.issue_id" - for _, id := range labelIDs { - if id == 0 { - continue - } - validJoin = true - queryStr += " AND issue_label.label_id=" + com.ToStr(id) - } - if validJoin { - sess.Join("INNER", "issue_label", queryStr) - } + if len(labelIDs) > 1 { + sess.Join("INNER", "issue_label", "issue.id = issue_label.issue_id").In("issue_label.label_id", labelIDs) } if opts.IsMention { - queryStr := "issue.id=issue_user.issue_id AND issue_user.is_mentioned=1" + sess.Join("INNER", "issue_user", "issue.id = issue_user.issue_id AND issue_user.is_mentioned = 1") + if opts.UserID > 0 { - queryStr += " AND issue_user.uid=" + com.ToStr(opts.UserID) + sess.Where("issue_user.uid = ?", opts.UserID) } - sess.Join("INNER", "issue_user", queryStr) } issues := make([]*Issue, 0, setting.IssuePagingNum)