Update CRUDService to quote "Sort" parameters for PG

mtwomey · mtwomey · commit e558acc78bf7 · 2016-05-26T15:05:37.000-05:00
diff --git a/Backend/src/modules/crud/services/CRUDService.js b/Backend/src/modules/crud/services/CRUDService.js
@@ -194,7 +194,7 @@ function _searchQuery(tableName, criteria, columns) {
     if (!_.find(columns, c => c.name === criteria.sortBy)) {
       throw new ValidationError(`There is no such column called '${criteria.sortBy}' for '${tableName}'`);
     }
-    orderBy = `ORDER BY ${criteria.sortBy} `;
+    orderBy = `ORDER BY ${_escapeName(criteria.sortBy)} `;
     if (criteria.sortOrder) {
       orderBy += criteria.sortOrder === 'Descending' ? 'DESC' : 'ASC';
     }

Original file line number	Diff line number	Diff line change
`@@ -194,7 +194,7 @@ function _searchQuery(tableName, criteria, columns) {`
`194`	`194`	`if (!_.find(columns, c => c.name === criteria.sortBy)) {`
`195`	`195`	throw new ValidationError(`There is no such column called '${criteria.sortBy}' for '${tableName}'`);
`196`	`196`	`}`
`197`		- orderBy = `ORDER BY ${criteria.sortBy} `;
	`197`	+ orderBy = `ORDER BY ${_escapeName(criteria.sortBy)} `;
`198`	`198`	`if (criteria.sortOrder) {`
`199`	`199`	`orderBy += criteria.sortOrder === 'Descending' ? 'DESC' : 'ASC';`
`200`	`200`	`}`