admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

case 4676 - data-list numeric and roles filters: parse values, never append client text

Browse Source 
Roles and every numeric type (Decimal, Currency, Integer, InternalId, Enum,
MemorySize) now parse the filter value as an invariant decimal or long and
append the re-formatted number. An invalid value throws ArgumentException
before any SQL runs. Covers the types Sockeye's fix (3427cd8) missed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-22 14:36:28 -07:00
parent 627f1bc7ed
commit 1ca07f1321
2 changed files with 23 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
server/AyaNova/DataList/DataListSqlFilterCriteriaBuilder.cs
View File

@@ -338,6 +338,12 @@ namespace AyaNova.DataList
EQUALITY:
just a simple = or <> i.e. where roles=4096 or roles!=4096
*/
//case 4676 - roles are a bitmask, only a whole number is valid, never put client text into the query
if (!long.TryParse(sValue, NumberStyles.Integer, CultureInfo.InvariantCulture, out var roleValue))
throw new System.ArgumentException($"DataListSqlFilterCriteriaBuilder invalid ROLES filter value [{sValue}]");
sValue = roleValue.ToString(CultureInfo.InvariantCulture);
switch (sOperator)
{
case DataListFilterComparisonOperator.Equality:
@@ -861,6 +867,21 @@ namespace AyaNova.DataList
break;
}
//case 4676 - every numeric type must parse as a number, never put client text into the query
//Decimal and Currency as decimal, Integer, InternalId, Enum and MemorySize as whole numbers
if (DataType == UiFieldDataType.Decimal || DataType == UiFieldDataType.Currency)
{
if (!decimal.TryParse(sValue, NumberStyles.Number, CultureInfo.InvariantCulture, out var decimalValue))
throw new System.ArgumentException($"DataListSqlFilterCriteriaBuilder invalid NUMBER filter value [{sValue}]");
sValue = decimalValue.ToString(CultureInfo.InvariantCulture);
}
else
{
if (!long.TryParse(sValue, NumberStyles.Integer, CultureInfo.InvariantCulture, out var wholeValue))
throw new System.ArgumentException($"DataListSqlFilterCriteriaBuilder invalid NUMBER filter value [{sValue}]");
sValue = wholeValue.ToString(CultureInfo.InvariantCulture);
}
switch (sOperator)
{
case DataListFilterComparisonOperator.Equality: