forked from mirror/gitea
d827215011
Unfortunately xorm's `builder.Select(...).From(...)` does not escape the
table names. This is mostly not a problem but is a problem with the
`user` table.
This PR simply escapes the user table. No other uses of `From("user")`
where found in the codebase so I think this should be all that is
needed.
Fix #23064
Signed-off-by: Andrew Thornton <art27@cantab.net>
|
||
|---|---|---|
| .. | ||
| assignees_test.go | ||
| assignees.go | ||
| comment_code.go | ||
| comment_list.go | ||
| comment_test.go | ||
| comment.go | ||
| content_history_test.go | ||
| content_history.go | ||
| dependency_test.go | ||
| dependency.go | ||
| issue_index.go | ||
| issue_list_test.go | ||
| issue_list.go | ||
| issue_lock.go | ||
| issue_project.go | ||
| issue_test.go | ||
| issue_user_test.go | ||
| issue_user.go | ||
| issue_watch_test.go | ||
| issue_watch.go | ||
| issue_xref_test.go | ||
| issue_xref.go | ||
| issue.go | ||
| label_test.go | ||
| label.go | ||
| main_test.go | ||
| milestone_test.go | ||
| milestone.go | ||
| pull_list.go | ||
| pull_test.go | ||
| pull.go | ||
| reaction_test.go | ||
| reaction.go | ||
| review_test.go | ||
| review.go | ||
| stopwatch_test.go | ||
| stopwatch.go | ||
| tracked_time_test.go | ||
| tracked_time.go | ||