diff options
| author | Adrian Holovaty <adrian@holovaty.com> | 2005-11-14 01:44:35 +0000 |
|---|---|---|
| committer | Adrian Holovaty <adrian@holovaty.com> | 2005-11-14 01:44:35 +0000 |
| commit | f6bf41e59ac032c253e3b4e1b267010c6d456a26 (patch) | |
| tree | a2b7755ee377b3cd99ff301154d9ae9a35991b1c /django/models | |
| parent | 6e40d8c29f2b6ed926cf764f5c9cdce07bc9a069 (diff) | |
Fixed #121 -- Django now quotes all names in SQL queries. Also added unit tests to confirm. Thanks, Robin Munn and Sune.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@1224 bcc190cf-cafb-0310-a4f2-bffc1f526a37
Diffstat (limited to 'django/models')
| -rw-r--r-- | django/models/auth.py | 25 |
1 files changed, 19 insertions, 6 deletions
diff --git a/django/models/auth.py b/django/models/auth.py index ef13fbea69..d0c13f66ce 100644 --- a/django/models/auth.py +++ b/django/models/auth.py @@ -91,12 +91,25 @@ class User(meta.Model): if not hasattr(self, '_group_perm_cache'): import sets cursor = db.cursor() - cursor.execute(""" - SELECT p.package, p.codename - FROM auth_permissions p, auth_groups_permissions gp, auth_users_groups ug - WHERE p.id = gp.permission_id - AND gp.group_id = ug.group_id - AND ug.user_id = %s""", [self.id]) + # The SQL below works out to the following, after DB quoting: + # cursor.execute(""" + # SELECT p.package, p.codename + # FROM auth_permissions p, auth_groups_permissions gp, auth_users_groups ug + # WHERE p.id = gp.permission_id + # AND gp.group_id = ug.group_id + # AND ug.user_id = %s""", [self.id]) + sql = """ + SELECT p.%s, p.%s + FROM %s p, %s gp, %s ug + WHERE p.%s = gp.%s + AND gp.%s = ug.%s + AND ug.%s = %%s""" % ( + db.quote_name('package'), db.quote_name('codename'), + db.quote_name('auth_permissions'), db.quote_name('auth_groups_permissions'), + db.quote_name('auth_users_groups'), db.quote_name('id'), + db.quote_name('permission_id'), db.quote_name('group_id'), + db.quote_name('group_id'), db.quote_name('user_id')) + cursor.execute(sql, [self.id]) self._group_perm_cache = sets.Set(["%s.%s" % (row[0], row[1]) for row in cursor.fetchall()]) return self._group_perm_cache |