11 ms·
This convenience sounds a little dangerous. Would this allow the user to specify e.g. joins or SQL procedure calls using the query parameter?
by ptx 2mo ago
This convenience sounds a little dangerous. Would this allow the user to specify e.g. joins or SQL procedure calls using the query parameter?
- zbentley 2mo agoIf you mean “would it allow arbitrary queries in the admin interface?”, then yes, it would. That’s why it’s the admin interface. If you mean “would it allow arbitrary queries from normal view code”, then no it would not—not unless you string eval on the backend or something else dangerous.