From 1d993755785571581bf62262180610152c1832bc Mon Sep 17 00:00:00 2001 From: yumoqing Date: Fri, 3 Jul 2026 15:29:08 +0800 Subject: [PATCH] fix: use whitelist approach - only pass known table columns to sor.I --- wwwroot/api/supply_contracts_create.dspy | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/wwwroot/api/supply_contracts_create.dspy b/wwwroot/api/supply_contracts_create.dspy index 4bd9231..449045e 100644 --- a/wwwroot/api/supply_contracts_create.dspy +++ b/wwwroot/api/supply_contracts_create.dspy @@ -3,11 +3,13 @@ user_id = await get_user() user_orgid = (await get_userorgid()) or '0' dbname = get_module_dbname('supplychain') -data = dict(params_kw) -# Clean non-table params and _text suffix fields -for key in list(data.keys()): - if key.startswith('_') or key.endswith('_text') or key in ['page', 'rows', 'data_filter', 'pagerows', 'referer_widget']: - data.pop(key, None) +# Only keep known table columns +known_cols = {'contract_name', 'sign_date', 'start_date', 'end_date', 'status', 'default_discount', 'remark', 'supplier_id', 'contract_code'} +data = {} +for k, v in params_kw.items(): + if k in known_cols and v is not None and v != '': + data[k] = v + data['id'] = getID() data['resellerid'] = user_orgid data['created_by'] = user_id