mirror/hotomoe
1
0
Fork 0
mirror of https://github.com/hotomoe/hotomoe synced 2024-11-25 15:46:17 +09:00
Code

Fix #6016

Browse Source
This commit is contained in:
syuilo 2020-02-20 07:18:40 +09:00
parent 177e19632a
commit 09175b84df
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/server/api/endpoints/notes/search-by-tag.ts
View File

@ -6,6 +6,7 @@ import { Notes } from '../../../../models';
import { generateMuteQuery } from '../../common/generate-mute-query';
import { generateVisibilityQuery } from '../../common/generate-visibility-query';
import { Brackets } from 'typeorm';
import { safeForSql } from '../../../../misc/safe-for-sql';
export const meta = {
desc: {
@ -99,7 +100,7 @@ export default define(meta, async (ps, me) => {
if (me) generateMuteQuery(query, me);
if (ps.tag) {
if (/[\0\x08\x09\x1a\n\r"'\\\%]/g.test(ps.tag)) return;
if (!safeForSql(ps.tag)) return;
query.andWhere(`'{"${ps.tag.toLowerCase()}"}' <@ note.tags`);
} else {
let i = 0;
@ -107,7 +108,8 @@ export default define(meta, async (ps, me) => {
for (const tags of ps.query!) {
qb.orWhere(new Brackets(qb => {
for (const tag of tags) {
qb.andWhere(`:tag${i} = ANY(note.tags)`, { [`tag${i}`]: tag.toLowerCase() });
if (!safeForSql(tag)) return;
qb.andWhere(`'{"${tag.toLowerCase()}"}' <@ note.tags`);
i++;
}
}));