cartodb4/observatory-extension
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

making obs_search a bit more secure

Browse Source
This commit is contained in:
Stuart Lynn 2016-04-20 13:42:13 -04:00
parent 6e9f4a03d1
commit a29876f47f
1 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/pg/sql/42_observatory_exploration.sql
View File

@ -3,7 +3,7 @@
-- TODO allow the user to specify the boundary to search for measures -- TODO allow the user to specify the boundary to search for measures
-- --
CREATE OR REPLACE FUNCTION cdb_observatory.OBS_Search( CREATE OR REPLACE FUNCTION cdb_observatory.OBS_Search_STU(
search_term text, search_term text,
relevant_boundary text DEFAULT null relevant_boundary text DEFAULT null
) )
@ -24,10 +24,21 @@ BEGIN
aggregate, aggregate,
replace(split_part(id,'".', 1),'"', '') source replace(split_part(id,'".', 1),'"', '') source
FROM observatory.OBS_column FROM observatory.OBS_column
where name ilike '%%%s%%' where name ilike '%'|| %L || '%'
or description ilike '%%%s%%' or description ilike '%'|| %L || '%'
%s %s
$string$, search_term, search_term,boundary_term); $string$, search_term, search_term,boundary_term);
RETURN; RETURN;
END END
$$ LANGUAGE plpgsql; $$ LANGUAGE plpgsql;
CREATE OR REPLACE FUNCTION OBS_GetAvailableBoundaries(geometry location)
RETURNS TABLE(description text, name text, id text) as $$
BEGIN
RETURN QUERY
EXECUTE format($string$
Select description, name, id FROM observatory.OBS_column
$string$)
END
$$