From f974477eccda9e672a4e8c8c10e29c4e706744a2 Mon Sep 17 00:00:00 2001 From: Jake Barnby Date: Thu, 23 Mar 2023 17:32:44 +1300 Subject: [PATCH] Use plain param to allow validating against collection attributes --- app/controllers/api/databases.php | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/app/controllers/api/databases.php b/app/controllers/api/databases.php index fbab889d25..e6c5286781 100644 --- a/app/controllers/api/databases.php +++ b/app/controllers/api/databases.php @@ -2800,14 +2800,12 @@ App::get('/v1/databases/:databaseId/collections/:collectionId/documents/:documen ->param('databaseId', '', new UID(), 'Database ID.') ->param('collectionId', '', new UID(), 'Collection ID. You can create a new collection using the Database service [server integration](https://appwrite.io/docs/server/databases#databasesCreateCollection).') ->param('documentId', '', new UID(), 'Document ID.') - ->param('queries', [], new Queries(new Select()), 'Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/databases#querying-documents). Only supported methods are limit and offset', true) + ->param('queries', [], new ArrayList(new Text(APP_LIMIT_ARRAY_ELEMENT_SIZE), APP_LIMIT_ARRAY_PARAMS_SIZE), 'Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/databases#querying-documents). Only method allowed is select.', true) ->inject('response') ->inject('dbForProject') ->inject('mode') ->action(function (string $databaseId, string $collectionId, string $documentId, array $queries, Response $response, Database $dbForProject, string $mode) { - var_dump($queries); - $database = Authorization::skip(fn () => $dbForProject->getDocument('databases', $databaseId)); if ($database->isEmpty()) { @@ -2822,6 +2820,13 @@ App::get('/v1/databases/:databaseId/collections/:collectionId/documents/:documen } } + // Validate queries + $queriesValidator = new Queries(new Select($collection->getAttribute('attributes'))); + $validQueries = $queriesValidator->isValid($queries); + if (!$validQueries) { + throw new Exception(Exception::GENERAL_ARGUMENT_INVALID, $queriesValidator->getDescription()); + } + $documentSecurity = $collection->getAttribute('documentSecurity', false); $validator = new Authorization(Database::PERMISSION_READ); $valid = $validator->isValid($collection->getRead());