Sitelet https://github.com/inventree/InvenTree/pull/12771
Skip to content

Metadata fix - #12771

Merged
SchrodingersGat merged 3 commits into
inventree:masterfrom
SchrodingersGat:metadata-fix
Sep 2, 2026
Merged

Metadata fix#12771
SchrodingersGat merged 3 commits into
inventree:masterfrom
SchrodingersGat:metadata-fix

Conversation

@SchrodingersGat

@SchrodingersGat SchrodingersGat commented Sep 2, 2026

Copy link
Copy Markdown
Member

Limit scope of query lookup on metadata API endpoints. Only allow certain attributes to be used for database field lookup.

@SchrodingersGat SchrodingersGat added this to the 1.6.0 milestone Sep 2, 2026
@SchrodingersGat SchrodingersGat added bug Identifies a bug which needs to be addressed security Relates to a security issue backport Apply this label to a PR to enable auto-backport action backport-to-1.5.x labels Sep 2, 2026
@netlify

netlify Bot commented Sep 2, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for inventree-web-pui-preview canceled.

Name Link
🔨 Latest commit 95b8ecd
🔍 Latest deploy log https://app.netlify.com/projects/inventree-web-pui-preview/deploys/6a98a54d6a1aa40007c48505

@codecov

codecov Bot commented Sep 2, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.12%. Comparing base (4024075) to head (95b8ecd).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files 
@@           Coverage Diff           @@
##           master   #12771   +/-   ##
=======================================
  Coverage   87.11%   87.12%           
=======================================
  Files        1483     1483           
  Lines      100403   100427   +24     
  Branches    11606    11606           
=======================================
+ Hits        87467    87494   +27     
+ Misses      12871    12868    -3     
  Partials       65       65
Flag Coverage Δ
backend 91.14% <100.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components Coverage Δ
Backend Apps 92.41% <ø> (ø)
Backend General 94.68% <ø> (ø)
Frontend 79.77% <ø> (ø)
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@SchrodingersGat
SchrodingersGat merged commit 694d890 into inventree:master Sep 2, 2026
46 checks passed
@SchrodingersGat
SchrodingersGat deleted the metadata-fix branch September 2, 2026 23:51
@github-actions github-actions Bot mentioned this pull request Sep 2, 2026
Merged
@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

💚 All backports created successfully

Status Branch Result
✅ 1.5.x

Questions ?

Please refer to the Backport tool documentation and see the Github Action logs for details

SchrodingersGat added a commit that referenced this pull request Sep 3, 2026
@github-actions @SchrodingersGat
Metadata fix (#12771) (#12775)
1c4cfd8 
* Fix security hole for metadata API

* Regression test for field injection

(cherry picked from commit 694d890)

Co-authored-by: Oliver <oliver.henry.walters@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@matmair matmair matmair approved these changes

Assignees

No one assigned

Labels

backport Apply this label to a PR to enable auto-backport action backport-to-1.5.x bug Identifies a bug which needs to be addressed security Relates to a security issue

Projects

None yet

Milestone

1.6.0

Development

Successfully merging this pull request may close these issues.

2 participants

@SchrodingersGat @matmair