-
Notifications
You must be signed in to change notification settings - Fork 2
Description
From PR #224 :
campus/campus/yapper/backends/sqlite.py
Lines 116 to 120 in 6d9bc0e
| # Notify subscriptions | |
| self._executemany( | |
| "INSERT INTO unread (client_id, event_id) VALUES (?, ?)", | |
| [(client_id, event_id) for client_id in subscriptions] | |
| ) |
The SQL query uses SQLite parameter style (
?) but theevent_idvariable is a dictionary. Line 108 extractsevent_idasresult["fetchall"][0]which returns the entire row dictionary, but the query expects just the ID value. Should beevent_id["id"].
campus/campus/yapper/backends/postgres.py
Lines 128 to 133 in 6d9bc0e
| # Notify subscriptions | |
| if subscriptions: | |
| self._executemany( | |
| "INSERT INTO unread (client_id, event_id) VALUES (%s, %s)", | |
| [(client_id, event_id) for client_id in subscriptions] | |
| ) |
Missing column
labelin the INSERT statement. The table schema on line 97-108 showsunreadtable has(client_id, label, event_id)as primary key, but the INSERT only providesclient_idandevent_id.
"INSERT INTO unread (client_id, label, event_id) VALUES (%s, %s, %s)",
[(client_id, label, event_id) for client_id in subscriptions]
campus/campus/yapper/backends/postgres.py
Lines 128 to 133 in 6d9bc0e
| # Notify subscriptions | |
| if subscriptions: | |
| self._executemany( | |
| "INSERT INTO unread (client_id, event_id) VALUES (%s, %s)", | |
| [(client_id, event_id) for client_id in subscriptions] | |
| ) |
The query attempts to insert
event_idfor each subscription, butevent_idis used in the list comprehension variable name while also being the extracted ID from line 118. This creates a variable name collision that could lead to incorrect values being inserted.
Metadata
Metadata
Assignees
Labels
Type
Projects
Status