Merge pull request #55 from glowingblue/gb-dev/safer-join-query

Specify wich table to select data from in join query
FriendsOfFlarum · Oct 7, 2022 · 0d31436 · 0d31436
2 parents a93c592 + f8dbe4d
commit 0d31436
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 2 deletions.
diff --git a/src/Jobs/SendNotificationWhenDiscussionIsReTagged.php b/src/Jobs/SendNotificationWhenDiscussionIsReTagged.php
@@ -59,7 +59,9 @@ public function handle(NotificationSyncer $notifications)
             return;
         }
 
-        $notify = User::where('users.id', '!=', $this->actor->id)
+        // The `select(...)` part is not mandatory here, but makes the query safer. See #55.
+        $notify = User::select('users.*')
+            ->where('users.id', '!=', $this->actor->id)
             ->join('tag_user', 'tag_user.user_id', '=', 'users.id')
             ->whereIn('tag_user.tag_id', $tagIds->all())
             ->whereIn('tag_user.subscription', ['follow', 'lurk'])

diff --git a/src/Jobs/SendNotificationWhenDiscussionIsStarted.php b/src/Jobs/SendNotificationWhenDiscussionIsStarted.php
@@ -53,7 +53,9 @@ public function handle(NotificationSyncer $notifications)
             return;
         }
 
-        $notify = User::where('users.id', '!=', $this->discussion->user_id)
+        // The `select(...)` part is not mandatory here, but makes the query safer. See #55.
+        $notify = User::select('users.*')
+            ->where('users.id', '!=', $this->discussion->user_id)
             ->join('tag_user', 'tag_user.user_id', '=', 'users.id')
             ->whereIn('tag_user.tag_id', $tagIds->all())
             ->whereIn('tag_user.subscription', ['follow', 'lurk'])

diff --git a/src/Jobs/SendNotificationWhenReplyIsPosted.php b/src/Jobs/SendNotificationWhenReplyIsPosted.php
@@ -60,6 +60,8 @@ public function handle(NotificationSyncer $notifications)
         }
 
         $notify = $this->post->discussion->readers()
+            // The `select(...)` part is not mandatory here, but makes the query safer. See #55.
+            ->select('users.*')
             ->where('users.id', '!=', $this->post->user_id)
             ->join('tag_user', 'tag_user.user_id', '=', 'users.id')
             ->whereIn('tag_user.tag_id', $tagIds->all())