fix: partial read permission on member table

bangumi · Dec 25, 2021 · 5102496 · 5102496
1 parent 572f8d9
commit 5102496
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/pol/curd/user.py b/pol/curd/user.py
@@ -47,7 +47,12 @@ async def get_by_valid_token(db: Database, access_token: str) -> User:
 
     access = ChiiOauthAccessToken(**r)
 
-    r = await db.fetch_one(sa.get(ChiiMember, ChiiMember.uid == access.user_id))
+    r = await db.fetch_one(
+        sa.get(
+            ChiiMember.all_column(),
+            ChiiMember.uid == access.user_id,
+        )
+    )
 
     if not r:
         # 有access token又没有对应的user不太可能发生，如果发生的话打个 log 当作验证失败

diff --git a/pol/db/tables.py b/pol/db/tables.py
@@ -142,6 +142,14 @@ class ChiiMember(Base):
     )
     sign = Column(VARCHAR(255), nullable=False)
 
+    @classmethod
+    def all_column(cls):
+        """
+        This table contains only column with read permission,
+        don't `select *` on this table.
+        """
+        return cls.__table__.columns
+
 
 class ChiiOauthAccessToken(Base):
     __tablename__ = "chii_oauth_access_tokens"