System-End/hackatime
1
0
Fork 0
mirror of https://github.com/System-End/hackatime.git synced 2026-04-19 22:15:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

whitelist create and deleted at

Browse source
This commit is contained in:
Echo 2025-08-24 16:41:22 -04:00
parent 6517f9b4ec
commit 3a803260bb
No known key found for this signature in database
GPG key ID: A1263DC479EDB62F
1 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
app/controllers/api/admin/v1/admin_controller.rb
View file

@ -257,6 +257,11 @@ module Api
return render json: { error: "no perms lmaooo" }, status: :forbidden
end
cool = %w[created_at deleted_at]
if query.upcase.match?(/\b(#{not_cool.join('|')})\b/) && !query.upcase.match?(/\b(#{cool.join('|')})\b/)
return render json: { error: "no perms lmaooo" }, status: :forbidden
end
begin
limited_query = query.strip
unless limited_query.upcase.include?("LIMIT")