diff options
| author | Omar Roth <omarroth@hotmail.com> | 2019-02-02 15:27:19 -0600 |
|---|---|---|
| committer | Omar Roth <omarroth@hotmail.com> | 2019-02-02 15:27:19 -0600 |
| commit | 9989c8100ae73b1f2cdfb409e66142b63d12142b (patch) | |
| tree | d3fe858d0b4623820e970137f71bf1e171912599 /src | |
| parent | d5c9b7dfe8055e939c555c32d106f02c7f983120 (diff) | |
| download | invidious-9989c8100ae73b1f2cdfb409e66142b63d12142b.tar.gz invidious-9989c8100ae73b1f2cdfb409e66142b63d12142b.tar.bz2 invidious-9989c8100ae73b1f2cdfb409e66142b63d12142b.zip | |
Properly escape email when creating view
Diffstat (limited to 'src')
| -rw-r--r-- | src/invidious.cr | 2 | ||||
| -rw-r--r-- | src/invidious/views/components/player.ecr | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/src/invidious.cr b/src/invidious.cr index 99f9e1af..abdd8cb9 100644 --- a/src/invidious.cr +++ b/src/invidious.cr @@ -1033,7 +1033,7 @@ post "/login" do |env| view_name = "subscriptions_#{sha256(user.email)[0..7]}" PG_DB.exec("CREATE MATERIALIZED VIEW #{view_name} AS \ SELECT * FROM channel_videos WHERE \ - ucid = ANY ((SELECT subscriptions FROM users WHERE email = '#{user.email}')::text[]) \ + ucid = ANY ((SELECT subscriptions FROM users WHERE email = E'#{user.email.gsub("'", "\\'")}')::text[]) \ ORDER BY published DESC;") if Kemal.config.ssl || CONFIG.https_only diff --git a/src/invidious/views/components/player.ecr b/src/invidious/views/components/player.ecr index 7f932ef4..99f99c58 100644 --- a/src/invidious/views/components/player.ecr +++ b/src/invidious/views/components/player.ecr @@ -121,7 +121,7 @@ player.on('error', function(event) { var currentTime = player.currentTime(); var playbackRate = player.playbackRate(); - var paused = player.paused() + var paused = player.paused(); player.load(); if (currentTime > 0.5) { |