Fix escaping for materialized view SQL

This commit is contained in:
Omar Roth 2019-07-09 09:34:19 -05:00
parent bcd239ac2b
commit 99b0b4f5b8
No known key found for this signature in database
GPG Key ID: B8254FB7EC3D37F2

View File

@ -1,7 +1,7 @@
require "crypto/bcrypt/password" require "crypto/bcrypt/password"
# Materialized views may not be defined using bound parameters (`$1` as used elsewhere) # Materialized views may not be defined using bound parameters (`$1` as used elsewhere)
MATERIALIZED_VIEW_SQL = ->(email : String) { "SELECT cv.* FROM channel_videos cv WHERE EXISTS (SELECT subscriptions FROM users u WHERE cv.ucid = ANY (u.subscriptions) AND u.email = E'#{email.gsub("'", "\\'")}') ORDER BY published DESC" } MATERIALIZED_VIEW_SQL = ->(email : String) { "SELECT cv.* FROM channel_videos cv WHERE EXISTS (SELECT subscriptions FROM users u WHERE cv.ucid = ANY (u.subscriptions) AND u.email = E'#{email.gsub({'\'' => "\\'", '\\' => "\\\\"})}') ORDER BY published DESC" }
struct User struct User
module PreferencesConverter module PreferencesConverter