UnitPickList.GetVariantCriteria put the value of a "customerid:<value>"
variant from the request into the query unparsed, reachable by any login
(security review F43, found during case 4712). The value is now parsed as a
long; anything else means no restriction, as 0 already did. The client's
format ("customerid: 5") still works.
Checked: new test fails on the old code, passes now; pick-list tests 10/10.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
151 lines
5.5 KiB
C#
151 lines
5.5 KiB
C#
using System.Collections.Generic;
|
|
using Newtonsoft.Json.Linq;
|
|
using AyaNova.Biz;
|
|
namespace AyaNova.PickList
|
|
{
|
|
internal class UnitPickList : AyaPickList, IAyaPickListVariant
|
|
{
|
|
public UnitPickList()
|
|
{
|
|
|
|
DefaultListAType = AyaType.Unit;
|
|
SQLFrom = "from aunit "
|
|
+ "left join aunitmodel on (aunit.unitmodelid=aunitmodel.id) "
|
|
+ "left join avendor on (aunitmodel.vendorid=avendor.id) ";
|
|
|
|
AllowedRoles = BizRoles.GetRoleSet(DefaultListAType).Select;
|
|
dynamic dTemplate = new JArray();
|
|
dynamic cm = null;
|
|
|
|
cm = new JObject();
|
|
cm.fld = "UnitSerial";
|
|
dTemplate.Add(cm);
|
|
|
|
cm = new JObject();
|
|
cm.fld = "UnitModelName";
|
|
dTemplate.Add(cm);
|
|
|
|
cm = new JObject();
|
|
cm.fld = "UnitModelVendorID";
|
|
dTemplate.Add(cm);
|
|
|
|
cm = new JObject();
|
|
cm.fld = "Tags";
|
|
dTemplate.Add(cm);
|
|
|
|
base.DefaultTemplate = dTemplate.ToString(Newtonsoft.Json.Formatting.None);
|
|
|
|
//NOTE: Due to the join, all the sql id and name fields that can conflict with the joined table need to be specified completely
|
|
ColumnDefinitions = new List<AyaPickListFieldDefinition>();
|
|
ColumnDefinitions.Add(new AyaPickListFieldDefinition
|
|
{
|
|
TKey = "Active",
|
|
FieldKey = "unitactive",
|
|
ColumnDataType = UiFieldDataType.Bool,
|
|
SqlValueColumnName = "aunit.active",
|
|
IsActiveColumn = true
|
|
});
|
|
|
|
ColumnDefinitions.Add(new AyaPickListFieldDefinition
|
|
{
|
|
TKey = "UnitSerial",
|
|
FieldKey = "UnitSerial",
|
|
ColumnDataType = UiFieldDataType.Text,
|
|
SqlIdColumnName = "aunit.id",
|
|
SqlValueColumnName = "aunit.serial",
|
|
IsRowId = true
|
|
});
|
|
|
|
ColumnDefinitions.Add(new AyaPickListFieldDefinition
|
|
{
|
|
FieldKey = "UnitModelName",
|
|
TKey = "UnitModelName",
|
|
ColumnDataType = UiFieldDataType.Text,
|
|
SqlIdColumnName = "aunitmodel.id",
|
|
SqlValueColumnName = "aunitmodel.name"
|
|
});
|
|
|
|
|
|
ColumnDefinitions.Add(new AyaPickListFieldDefinition
|
|
{
|
|
FieldKey = "UnitModelVendorID",
|
|
TKey = "UnitModelVendorID",
|
|
ColumnDataType = UiFieldDataType.Text,
|
|
SqlIdColumnName = "avendor.id",
|
|
SqlValueColumnName = "avendor.name"
|
|
});
|
|
|
|
ColumnDefinitions.Add(new AyaPickListFieldDefinition
|
|
{
|
|
TKey = "UnitDescription",
|
|
FieldKey = "UnitDescription",
|
|
ColumnDataType = UiFieldDataType.Text,
|
|
SqlValueColumnName = "aunit.description"
|
|
});
|
|
|
|
ColumnDefinitions.Add(new AyaPickListFieldDefinition
|
|
{
|
|
TKey = "UnitText1",
|
|
FieldKey = "UnitText1",
|
|
ColumnDataType = UiFieldDataType.Text,
|
|
SqlValueColumnName = "aunit.text1"
|
|
});
|
|
|
|
ColumnDefinitions.Add(new AyaPickListFieldDefinition
|
|
{
|
|
TKey = "UnitText2",
|
|
FieldKey = "UnitText2",
|
|
ColumnDataType = UiFieldDataType.Text,
|
|
SqlValueColumnName = "aunit.text2"
|
|
});
|
|
|
|
ColumnDefinitions.Add(new AyaPickListFieldDefinition
|
|
{
|
|
TKey = "UnitText3",
|
|
FieldKey = "UnitText3",
|
|
ColumnDataType = UiFieldDataType.Text,
|
|
SqlValueColumnName = "aunit.text3"
|
|
});
|
|
|
|
ColumnDefinitions.Add(new AyaPickListFieldDefinition
|
|
{
|
|
TKey = "UnitText4",
|
|
FieldKey = "UnitText4",
|
|
ColumnDataType = UiFieldDataType.Text,
|
|
SqlValueColumnName = "aunit.text4"
|
|
});
|
|
|
|
ColumnDefinitions.Add(new AyaPickListFieldDefinition
|
|
{
|
|
TKey = "Tags",
|
|
FieldKey = "Tags",
|
|
ColumnDataType = UiFieldDataType.Tags,
|
|
SqlValueColumnName = "aunit.tags"
|
|
});
|
|
|
|
}
|
|
|
|
public string GetVariantCriteria(string variant)
|
|
{
|
|
//this variant is a name, value combination to restrict to a customer owner
|
|
//e.g. "customerid:33"
|
|
if (string.IsNullOrWhiteSpace(variant))
|
|
return string.Empty;
|
|
|
|
if (!variant.Contains(":"))
|
|
throw new System.ArgumentOutOfRangeException("UnitPickList variant required to be format 'customerid:idvalue' if specified");
|
|
|
|
var v = variant.Split(":");
|
|
switch (v[0])
|
|
{
|
|
case "customerid":
|
|
//case 4716: the id goes into the SQL, so it must be a number (anything else: no restriction, as for 0)
|
|
if (!long.TryParse(v[1].Trim(), System.Globalization.NumberStyles.Integer, System.Globalization.CultureInfo.InvariantCulture, out long customerId) || customerId == 0)
|
|
return string.Empty;
|
|
return $"aunit.customerid = {customerId}";
|
|
|
|
}
|
|
return string.Empty;
|
|
}
|
|
}//eoc
|
|
}//eons |