From 1a08f98548044156d2f37391a92e3532e1e155b4 Mon Sep 17 00:00:00 2001 From: Kallesh B S Date: Sat, 27 Sep 2025 18:02:26 +0530 Subject: [PATCH] auth fix 6 --- .../carnet-application.service.ts | 33 ++++++++----------- 1 file changed, 14 insertions(+), 19 deletions(-) diff --git a/src/pg/carnet-application/carnet-application.service.ts b/src/pg/carnet-application/carnet-application.service.ts index 98178e8..a4cda4a 100644 --- a/src/pg/carnet-application/carnet-application.service.ts +++ b/src/pg/carnet-application/carnet-application.service.ts @@ -267,36 +267,31 @@ export class CarnetApplicationService { await client.query('BEGIN'); - function escapePostgresString(str: string): string { + function escapePostgresCompositeField(str: string): string { if (str == null) return ''; - return `"${str.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`; - } - - function escapePostgresValue(val: any): string { - if (val == null || val === '') return ''; // NULL or empty becomes empty string - if (typeof val === 'number') return String(val); // pass numbers as-is - return escapePostgresString(String(val)); // quote and escape strings + return str.replace(/\\/g, '\\\\').replace(/"/g, '""'); } const contactLiterals = body.P_GLTABLE.map(c => { const fields = [ - escapePostgresValue(c.ITEMNO), // integer - escapePostgresValue(c.ITEMDESCRIPTION), // varchar - escapePostgresValue(c.ITEMVALUE), // numeric - escapePostgresValue(c.NOOFPIECES), // integer - escapePostgresValue(c.ITEMWEIGHT), // numeric - escapePostgresValue(c.ITEMWEIGHTUOM), // varchar - escapePostgresValue(c.GOODSORIGINCOUNTRY), // varchar - ]; + c.ITEMNO ?? '', + c.ITEMDESCRIPTION ?? '', + c.ITEMVALUE ?? '', + c.NOOFPIECES ?? '', + c.ITEMWEIGHT ?? '', + c.ITEMWEIGHTUOM ?? '', + c.GOODSORIGINCOUNTRY ?? '', + ].map(field => escapePostgresCompositeField(String(field))).join(','); - return `(${fields.join(',')})`; // composite literal without outer double quotes + return `"(${fields})"`; // ✅ Wrap each composite in double quotes }); const pgArrayLiteral = `{${contactLiterals.join(',')}}`; const callProcQuery = ` - CALL "CARNETSYS".carnetapplication_pkg_editgenerallistitems($1, $2::"CARNETSYS".gltable[], $3, $4) - `; + CALL "CARNETSYS".carnetapplication_pkg_editgenerallistitems($1, $2::"CARNETSYS".gltable[], $3, $4) +`; + await client.query(callProcQuery, [body.P_HEADERID, pgArrayLiteral, body.P_USERID, cursorName]); // 🚫 DON'T quote the cursor name in FETCH