smishchuk/svc-api-x
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

108 bookmark claen fix

Browse Source
This commit is contained in:
msyu
2025-05-16 17:15:05 +03:00
parent 381f5f1b4e
commit e4832ee878
6 changed files with 15 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
v1/Application.cfc
+1 -1
View File
@@ -51,7 +51,7 @@
//variables.framework.docs={};
variables.framework.docs.APIName="Deck API";
variables.framework.docs.APIVersion="0.107"; /*$ git config --global --unset user.password*/
variables.framework.docs.APIVersion="0.108"; /*$ git config --global --unset user.password*/
variables.framework.globalHeaders = structNew();
v1/resources/bookmark.cfc
+3 -3
View File
@@ -81,13 +81,13 @@
,descr=<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.descr)#"/>
</cfif>
<cfif structKeyExists(arguments,"url")>
,url=<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.url)#"/>
,url=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.url#"/>
</cfif>
<cfif structKeyExists(arguments,"iconUrl")>
,icon_url=<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.iconUrl)#"/>
,icon_url=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.iconUrl#"/>
</cfif>
<cfif structKeyExists(arguments,"sort")>
,sort=<cfqueryparam cfsqltype="cf_sql_integer" value="#cleanInput(arguments.sort)#"/>
,sort=<cfqueryparam cfsqltype="cf_sql_integer" value="#arguments.sort#"/>
</cfif>
<cfif structKeyExists(arguments,"isEnabled")>
,is_enabled=<cfqueryparam cfsqltype="cf_sql_bit" value="#arguments.isEnabled#"/>
v1/resources/bookmark_ls.cfc
+2 -2
View File
@@ -146,8 +146,8 @@
<cfqueryparam cfsqltype="cf_sql_other" value="#local.bookmarkUid#"/>
,<cfqueryparam cfsqltype="cf_sql_integer" value="#arguments.contragentId#"/>
,<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.bookmark)#"/>
,<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.url)#"/>
,<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.iconUrl)#"/>
,<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.url#"/>
,<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.iconUrl#"/>
,<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.descr)#"/>
,<cfqueryparam cfsqltype="cf_sql_integer" value="#arguments.sort#"/>
,<cfqueryparam cfsqltype="cf_sql_bit" value="#arguments.isEnabled#" null=#!isValid("boolean",arguments.isEnabled)#/>
v1/resources/instance_operation.cfc
+1 -1
View File
@@ -186,7 +186,7 @@
select
sp.instance_operation_cfs_param_uid::text as instance_operation_cfs_param_uid
,sp.instance_operation_cfs_subparam
,sp.descr
,sp.note
,sp.sort
,sp.is_sensitive
from instance_operation_cfs_subparam sp
v1/resources/instance_operation_cfs_param.cfc
+1 -1
View File
@@ -29,7 +29,7 @@
<m:field>iop.instance_operation_uid::text as instance_operation_uid</m:field>
<m:field>iop.svc_operation_cfs_param_id</m:field>
<!--- <m:field>iop.param_value</m:field> --->
<m:field>case when sop.is_sensitive then '********' else iop.param_value end as param_value </m:field>
<m:field>case when sop.is_sensitive then '********' else iop.param_value end as param_value </m:field><!--- внимание! если параметр типа MAP, то значение нужно разобрать и замаскировать секреты --->
<m:field>iop.note</m:field>
<m:field>to_char(iop.dt_created, 'YYYY-MM-DD"T"HH24:MI:SS.FF3TZHTZM') as dt_created</m:field>
<m:field>iop.creator_id</m:field>
v1/resources/instance_operation_cfs_subparam.cfc
+7 -7
View File
@@ -161,13 +161,13 @@
</cfif>
<cfquery name="local.qSave" result="local.result">
update instance_operation_cfs_subparam set
dt_updated=<cfqueryparam cfsqltype="cf_sql_timestamp" value="#Now()#" />
,updater_id=<cfqueryparam cfsqltype="cf_sql_integer" value="#arguments.usrId#" />
,is_sensitive=<cfqueryparam cfsqltype="cf_sql_bit" value="#arguments.isSensitive#" />
,note=<cfqueryparam cfsqltype="cf_sql_varchar" value="#htmlEditFormat(arguments.note)#" /> <!--- *** XSS!!! --->
where instance_operation_cfs_param_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationCfsParamUid#" null=#!isValid('guid',arguments.instanceOperationCfsParamUid)#/>
AND iop.instance_operation_cfs_subparam=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.subparam#"/>
update instance_operation_cfs_subparam set
dt_updated=<cfqueryparam cfsqltype="cf_sql_timestamp" value="#Now()#" />
,updater_id=<cfqueryparam cfsqltype="cf_sql_integer" value="#arguments.usrId#" />
,is_sensitive=<cfqueryparam cfsqltype="cf_sql_bit" value="#arguments.isSensitive#" />
,note=<cfqueryparam cfsqltype="cf_sql_varchar" value="#htmlEditFormat(arguments.note)#" /> <!--- *** XSS!!! --->
where instance_operation_cfs_param_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationCfsParamUid#" null=#!isValid('guid',arguments.instanceOperationCfsParamUid)#/>
AND iop.instance_operation_cfs_subparam=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.subparam#"/>
</cfquery>
<!--- *** проверить существование - 404 --->
<cfreturn noData().withStatus(204, "No Content") />