[Mpuls-commits] r4916 - in base/trunk: . mpulsweb/controllers
scm-commit@wald.intevation.org
scm-commit at wald.intevation.org
Fri Apr 15 18:07:31 CEST 2011
Author: bh
Date: 2011-04-15 18:07:30 +0200 (Fri, 15 Apr 2011)
New Revision: 4916
Modified:
base/trunk/ChangeLog
base/trunk/mpulsweb/controllers/evaluate.py
Log:
* mpulsweb/controllers/evaluate.py (get_search_options)
(EvaluateController._get_evalparams): Add doc-strings.
Modified: base/trunk/ChangeLog
===================================================================
--- base/trunk/ChangeLog 2011-04-15 15:56:52 UTC (rev 4915)
+++ base/trunk/ChangeLog 2011-04-15 16:07:30 UTC (rev 4916)
@@ -1,5 +1,10 @@
2011-04-15 Bernhard Herzog <bh at intevation.de>
+ * mpulsweb/controllers/evaluate.py (get_search_options)
+ (EvaluateController._get_evalparams): Add doc-strings.
+
+2011-04-15 Bernhard Herzog <bh at intevation.de>
+
Remove the id_field form parameter to avoid SQL injections.
Fixes the rest of mpuls/issue1961
Modified: base/trunk/mpulsweb/controllers/evaluate.py
===================================================================
--- base/trunk/mpulsweb/controllers/evaluate.py 2011-04-15 15:56:52 UTC (rev 4915)
+++ base/trunk/mpulsweb/controllers/evaluate.py 2011-04-15 16:07:30 UTC (rev 4916)
@@ -49,6 +49,22 @@
def get_search_options(soptions=None, id=None, selected_ids=()):
+ """Return the values for the search parameters in the evaluation form.
+
+ The return value is a dictionary. The default values are taken from
+ the configuration. The parameter soptions, if given, should be a
+ dictionary containing previously used parameters. Usually this will
+ be a copy of a dictionary previously returned by this function.
+
+ The parameter id should be the id of the evaluation. It will be
+ returned in the dictionary with the key 'id'. The information from
+ the configuration file for the evaluation is expected to already be
+ available in the global c.evalconfig.
+
+ The parameter selected_ids should be a sequence of integers with the
+ ids of the cases selected for evaluation. If no cases were selected,
+ it should be an empty sequence.
+ """
options = {}
options['id'] = id
options["selected_ids"] = selected_ids
@@ -107,6 +123,20 @@
errors={}, auto_insert_errors=False)
def _get_evalparams(self, form_result, id_field, sql_where):
+ """Turn parameters from the evaluation form into evaluation parameters.
+ The parameter form_result should be a dictionary created from
+ the raw form paramters with EvaluationFormValidator.
+
+ The parameter id_field should be a string with an SQL expression
+ giving the field which should match the ids in the selected_ids
+ in form_result.
+
+ The parameter sql_where should be a string with an SQL
+ expression. It will be used directly in the sql_where expression
+ created by this method and will be combined with the other
+ clauses with 'AND'. If the sql_where is None or an empty string,
+ it will be ignored.
+ """
params = {}
params['id'] = form_result['id']
params['start_date'] = str(form_result['start_date'])
More information about the Mpuls-commits
mailing list