archtechx/tenancy
1
0
Fork 0
mirror of https://github.com/archtechx/tenancy.git synced 2026-05-07 07:14:04 +00:00
Code Activity

Validate SQLite DB names in create/deleteDatabase()

Browse source 
Also stop skipping the validation test for sqlite.
This commit is contained in:
lukinovec 2026-04-29 16:01:49 +02:00
parent d5087d19c5
commit db03997339
2 changed files with 13 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/Database/TenantDatabaseManagers/SQLiteDatabaseManager.php
View file

@ -7,12 +7,15 @@ namespace Stancl\Tenancy\Database\TenantDatabaseManagers;
use Closure;
use Illuminate\Database\Eloquent\Model;
use PDO;
use Stancl\Tenancy\Database\Concerns\ValidatesSqlParameters;
use Stancl\Tenancy\Database\Contracts\TenantDatabaseManager;
use Stancl\Tenancy\Database\Contracts\TenantWithDatabase;
use Throwable;
class SQLiteDatabaseManager implements TenantDatabaseManager
{
use ValidatesSqlParameters;
/**
* SQLite database directory path.
*
@ -57,6 +60,11 @@ class SQLiteDatabaseManager implements TenantDatabaseManager
*/
public static Closure|null $closeInMemoryConnectionUsing = null;
protected static function parameterAllowlist(): string
{
return 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-.';
}
public function createDatabase(TenantWithDatabase $tenant): bool
{
/** @var TenantWithDatabase&Model $tenant */
@ -84,6 +92,8 @@ class SQLiteDatabaseManager implements TenantDatabaseManager
return true;
}
$this->validateParameter($name);
return file_put_contents($this->getPath($name), '') !== false;
}
@ -99,6 +109,8 @@ class SQLiteDatabaseManager implements TenantDatabaseManager
return true;
}
$this->validateParameter($name);
$path = $this->getPath($name);
try {