From fd63ad2320143f2d24225961d70a755b904aa6c3 Mon Sep 17 00:00:00 2001 From: John Cardinal Date: Mon, 16 Mar 2020 22:32:28 +0000 Subject: [PATCH] --- server/AyaNova/PickList/PickListSqlBuilder.cs | 5 +++-- server/AyaNova/biz/PickListBiz.cs | 14 ++++++++++++-- 2 files changed, 15 insertions(+), 4 deletions(-) diff --git a/server/AyaNova/PickList/PickListSqlBuilder.cs b/server/AyaNova/PickList/PickListSqlBuilder.cs index f5dfa16a..669956b6 100644 --- a/server/AyaNova/PickList/PickListSqlBuilder.cs +++ b/server/AyaNova/PickList/PickListSqlBuilder.cs @@ -18,10 +18,11 @@ namespace AyaNova.PickList internal static string Build(IAyaPickList pickList, List templateColumnNames, string autoCompleteQuery, string tagSpecificQuery, bool IncludeInactive) { - + //determine this in advance as it will be used in a loop later bool HasAutoCompleteQuery = !string.IsNullOrWhiteSpace(autoCompleteQuery); - + bool HasTagSpecificQuery = !string.IsNullOrWhiteSpace(tagSpecificQuery); + //lists to collect the clauses so to avoid comma fuckery List lSelect = new List(); diff --git a/server/AyaNova/biz/PickListBiz.cs b/server/AyaNova/biz/PickListBiz.cs index 3acbb491..6fb7e81e 100644 --- a/server/AyaNova/biz/PickListBiz.cs +++ b/server/AyaNova/biz/PickListBiz.cs @@ -73,16 +73,26 @@ namespace AyaNova.Biz { // split the query on space var querySegments = AutoCompleteQuery.Split(' '); + if (querySegments.Length > 2) + { + AddError(ApiErrorCode.VALIDATION_INVALID_VALUE, "query", "LT:PickListQueryInvalid"); + return null; + } // users may type several spaces in a regular query, so ignore that and only use the first two segments if (querySegments[0].Contains("..")) { TagSpecificQuery = querySegments[0].Replace("..", ""); - // the second string is considered the AutoCompleteQuery = querySegments[1]; } + else if (querySegments[1].Contains("..")) + { + TagSpecificQuery = querySegments[1].Replace("..", ""); + AutoCompleteQuery = querySegments[0]; + } else { - + AddError(ApiErrorCode.VALIDATION_INVALID_VALUE, "query", "LT:PickListQueryInvalid"); + return null; } }