Nail/contractor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v1.0.176: spec_current cascade fix + keep_ids DoS limit

Browse Source
This commit is contained in:
naeel
2026-06-24 18:04:59 +04:00
parent 044a83a43d
commit cd5ba7470e
2 changed files with 28 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/convert_server.py
+14 -2
View File
@@ -163,7 +163,11 @@ class Handler(BaseHTTPRequestHandler):
doc_id = parsed.path.split("/")[-1]
supps = query("SELECT id, contract_id FROM supplements WHERE document_id = %s", (doc_id,))
for s in (supps or []):
execute("DELETE FROM spec_current WHERE contract_id = %s", (s["contract_id"],))
execute(
"""DELETE FROM spec_current WHERE contract_id = %s
AND last_event_id IN (SELECT id FROM spec_events WHERE supplement_id = %s)""",
(s["contract_id"], s["id"]),
)
execute("DELETE FROM spec_events WHERE supplement_id = %s", (s["id"],))
execute("DELETE FROM supplements WHERE id = %s", (s["id"],))
execute("DELETE FROM documents WHERE id = %s", (doc_id,))
@@ -177,6 +181,10 @@ class Handler(BaseHTTPRequestHandler):
length = int(self.headers.get("Content-Length", 0))
body = json.loads(self.rfile.read(length)) if length > 0 else {}
keep_ids = set(body.get("keep_ids", []))
# Prevent DoS: too many IDs
if len(keep_ids) > 1000:
self._json({"ok": False, "error": "too many keep_ids (max 1000)"}, 400)
return
docs = query("SELECT id FROM documents", ())
deleted = 0
for d in (docs or []):
@@ -184,7 +192,11 @@ class Handler(BaseHTTPRequestHandler):
continue
supps = query("SELECT id, contract_id FROM supplements WHERE document_id = %s", (d["id"],))
for s in (supps or []):
execute("DELETE FROM spec_current WHERE contract_id = %s", (s["contract_id"],))
execute(
"""DELETE FROM spec_current WHERE contract_id = %s
AND last_event_id IN (SELECT id FROM spec_events WHERE supplement_id = %s)""",
(s["contract_id"], s["id"]),
)
execute("DELETE FROM spec_events WHERE supplement_id = %s", (s["id"],))
execute("DELETE FROM supplements WHERE id = %s", (s["id"],))
execute("DELETE FROM documents WHERE id = %s", (d["id"],))