|
|
|
|
The following issue has been updated. |
|
Updater: Thierry Delprat
Date: 14/05/07 02:03
|
|
| Field |
Original Value |
New Value |
|
Change By
Thierry Delprat
on 14/05/07 02:03
|
|
Fix Version/s
|
5.1 M3
|
|
|
Fix Version/s
|
|
5.1 M4
|
|
Currently client components find documents by forging a string query such as:
String myQuery = "SELECT * FROM document WHERE prefix1:field1 = 'value1' AND prefix2:field2 = 'value2'"
and then feeding it to:
documentManager.query(myQuery)
Which is bad since it's up to the client code to implement NXQL escaping (security protection against NXQL injection).
So the new API instead accept:
String myQuery = "SELECT * FROM document WHERE prefix1:field1 = ? AND prefix2:field2 = ?"
Object[] params = new {"value1", "value2"};
documentManager.query(myQuery, params);
and the NXQL escaping should be handled by the server as this is done with the PreparedStatement class of JDBC for instance.
|
|
|
|
![]() |
|
_______________________________________________
ECM-tickets mailing list
[email protected]
http://lists.nuxeo.com/mailman/listinfo/ecm-tickets
