Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions models/org.go
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ func (org *User) GetOwnerTeam() (*Team, error) {
}

func (org *User) getTeams(e Engine) error {
return e.Where("org_id=?", org.ID).Find(&org.Teams)
return e.Where("org_id=?", org.ID).OrderBy("CASE WHEN name LIKE '" + OWNER_TEAM + "' THEN '' ELSE name END").Find(&org.Teams)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use proper SQL params instead of concatenating strings. Like this:

OrderBy("name LIKE ?", variable)

Also, why LIKE and not =?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not possible.

image

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK then, I thought it was possible.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree it should not be LIKE but equality operator.
Is OWNER_TEAM guaranteed to be SQL-safe ? I'd feel more comfortable if we did not rely on that and use some xorm-provided quoting function, is it available @lunny ?

}

// GetTeams returns all teams that belong to organization.
Expand Down Expand Up @@ -495,7 +495,7 @@ func (org *User) GetUserRepositories(userID int64, page, pageSize int) ([]*Repos
repos := make([]*Repository, 0, pageSize)
// FIXME: use XORM chain operations instead of raw SQL.
if err = x.Sql(fmt.Sprintf(`SELECT repository.* FROM repository
INNER JOIN team_repo
INNER JOIN team_repo
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need to test it but I think the space should stay.

Copy link
Contributor Author

@thibaultmeyer thibaultmeyer Nov 3, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no problem, the query still working cause SQL threat \n like space. You can see other files where space has been trimmed and the query still working

ON team_repo.repo_id = repository.id
WHERE (repository.owner_id = ? AND repository.is_private = ?) OR team_repo.team_id IN (%s)
GROUP BY repository.id
Expand All @@ -507,7 +507,7 @@ func (org *User) GetUserRepositories(userID int64, page, pageSize int) ([]*Repos
}

results, err := x.Query(fmt.Sprintf(`SELECT repository.id FROM repository
INNER JOIN team_repo
INNER JOIN team_repo
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here about the pending space since the SQL Query is multi-lines

Copy link
Contributor Author

@thibaultmeyer thibaultmeyer Nov 3, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no problem, the query still working cause SQL threat \n like space. You can see other files where space has been trimmed and the query still working

ON team_repo.repo_id = repository.id
WHERE (repository.owner_id = ? AND repository.is_private = ?) OR team_repo.team_id IN (%s)
GROUP BY repository.id
Expand All @@ -534,7 +534,7 @@ func (org *User) GetUserMirrorRepositories(userID int64) ([]*Repository, error)

repos := make([]*Repository, 0, 10)
if err = x.Sql(fmt.Sprintf(`SELECT repository.* FROM repository
INNER JOIN team_repo
INNER JOIN team_repo
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here about the pending space since the SQL Query is multi-lines

Copy link
Contributor Author

@thibaultmeyer thibaultmeyer Nov 3, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no problem, the query still working cause SQL threat \n like space. You can see other files where space has been trimmed and the query still working

ON team_repo.repo_id = repository.id AND repository.is_mirror = ?
WHERE (repository.owner_id = ? AND repository.is_private = ?) OR team_repo.team_id IN (%s)
GROUP BY repository.id
Expand Down