diff options
| author | Omar Roth <omarroth@protonmail.com> | 2019-11-04 12:26:05 -0500 |
|---|---|---|
| committer | Omar Roth <omarroth@protonmail.com> | 2019-11-04 12:26:05 -0500 |
| commit | 7b2ca55089d4fb65e574c7643d4ebdd307943011 (patch) | |
| tree | 490197755c6615bfc8b6b7acd7d8d8db449e2ab6 | |
| parent | f6ef0b684a05bc7f0260872268df484a77e78e7f (diff) | |
| download | invidious-7b2ca55089d4fb65e574c7643d4ebdd307943011.tar.gz invidious-7b2ca55089d4fb65e574c7643d4ebdd307943011.tar.bz2 invidious-7b2ca55089d4fb65e574c7643d4ebdd307943011.zip | |
Fix escaping in email query
| -rw-r--r-- | src/invidious.cr | 2 | ||||
| -rw-r--r-- | src/invidious/channels.cr | 4 |
2 files changed, 3 insertions, 3 deletions
diff --git a/src/invidious.cr b/src/invidious.cr index d2d20284..90b428f6 100644 --- a/src/invidious.cr +++ b/src/invidious.cr @@ -3389,7 +3389,7 @@ post "/feed/webhook/:token" do |env| if emails.empty? values = "'{}'" else - values = "VALUES #{emails.map { |id| %(('#{id}')) }.join(",")}" + values = "VALUES #{emails.map { |email| %((E'#{email.gsub({'\'' => "\\'", '\\' => "\\\\"})}')) }.join(",")}" end PG_DB.exec("UPDATE users SET feed_needs_update = true WHERE email = ANY(#{values})") diff --git a/src/invidious/channels.cr b/src/invidious/channels.cr index 2d911089..71ed4d59 100644 --- a/src/invidious/channels.cr +++ b/src/invidious/channels.cr @@ -281,7 +281,7 @@ def fetch_channel(ucid, db, pull_all_videos = true, locale = nil) if emails.empty? values = "'{}'" else - values = "VALUES #{emails.map { |id| %(('#{id}')) }.join(",")}" + values = "VALUES #{emails.map { |email| %((E'#{email.gsub({'\'' => "\\'", '\\' => "\\\\"})}')) }.join(",")}" end db.exec("UPDATE users SET feed_needs_update = true WHERE email = ANY(#{values})") @@ -349,7 +349,7 @@ def fetch_channel(ucid, db, pull_all_videos = true, locale = nil) if emails.empty? values = "'{}'" else - values = "VALUES #{emails.map { |id| %(('#{id}')) }.join(",")}" + values = "VALUES #{emails.map { |email| %((E'#{email.gsub({'\'' => "\\'", '\\' => "\\\\"})}')) }.join(",")}" end db.exec("UPDATE users SET feed_needs_update = true WHERE email = ANY(#{values})") |