Merge pull request #2 from po5/priv-view-unsafe-posts

server: prevent cache key collision
This commit is contained in:
Ilia Tetin
2025-03-26 19:15:33 +00:00
committed by GitHub
2 changed files with 9 additions and 1 deletions

View File

@ -228,6 +228,11 @@ class PostSearchConfig(BaseSearchConfig):
)
return query.order_by(model.Post.post_id.desc())
@property
def can_list_unsafe(self) -> bool:
return self.user and auth.has_privilege(self.user, "posts:list:unsafe")
@property
def id_column(self) -> SaColumn:
return model.Post.post_id

View File

@ -93,7 +93,10 @@ class Executor:
if token.name == "random":
disable_eager_loads = True
key = (id(self.config), hash(search_query), offset, limit)
can_list_unsafe = getattr(self.config, "can_list_unsafe", False)
key = (id(self.config), hash(search_query), offset, limit, can_list_unsafe)
if cache.has(key):
return cache.get(key)