yumoqing/supplychain
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: use whitelist approach - only pass known table columns to sor.I

Browse Source
This commit is contained in:
yumoqing 2026-07-03 15:29:08 +08:00
parent 959d021537
commit 1d99375578
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
wwwroot/api/supply_contracts_create.dspy
View File

@ -3,11 +3,13 @@ user_id = await get_user()
user_orgid = (await get_userorgid()) or '0' user_orgid = (await get_userorgid()) or '0'
dbname = get_module_dbname('supplychain') dbname = get_module_dbname('supplychain')
data = dict(params_kw) # Only keep known table columns
# Clean non-table params and _text suffix fields known_cols = {'contract_name', 'sign_date', 'start_date', 'end_date', 'status', 'default_discount', 'remark', 'supplier_id', 'contract_code'}
for key in list(data.keys()): data = {}
if key.startswith('_') or key.endswith('_text') or key in ['page', 'rows', 'data_filter', 'pagerows', 'referer_widget']: for k, v in params_kw.items():
data.pop(key, None) if k in known_cols and v is not None and v != '':
data[k] = v
data['id'] = getID() data['id'] = getID()
data['resellerid'] = user_orgid data['resellerid'] = user_orgid
data['created_by'] = user_id data['created_by'] = user_id