Skip to content

F
flask-admin
Commit 1b07f2cf authored by Raz0r's avatar Raz0r
Browse files
Options

escape data before being used in query 

dangerous!
parent 5a3918c5
Show whitespace changes
Inline Side-by-side
Showing with 5 additions and 3 deletions
flask_admin/contrib/pymongo/tools.py
View file @ 1b07f2cf
import re
def parse_like_term(term): def parse_like_term(term):
""" """
Parse search term into (operation, term) tuple Parse search term into (operation, term) tuple
...@@ -6,8 +8,8 @@ def parse_like_term(term): ...@@ -6,8 +8,8 @@ def parse_like_term(term):
Search term Search term
""" """
if term.startswith('^'): if term.startswith('^'):
return '^%s' % term[1:] return '^{}'.format(re.escape(term[1:]))
elif term.startswith('='): elif term.startswith('='):
return '^%s$' % term[1:] return '^{}$'.format(re.escape(term[1:]))
return '%s' % term return re.escape(term)
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment