@@ -2961,10 +2961,19 @@ public function getDocument(string $collection, string $id, array $queries = [],
29612961 }
29622962
29632963 $ selects = Query::getSelectQueries ($ queries );
2964- if (count ($ selects ) !== count ($ queries )){
2964+ if (count ($ selects ) !== count ($ queries )) {
2965+ // Do we want this check?
29652966 throw new QueryException ('Only select queries are allowed ' );
29662967 }
29672968
2969+ /**
2970+ * For security check
2971+ */
2972+ if (!empty ($ selects )) {
2973+ //$selects[] = Query::select('$id'); // Do we need this?
2974+ $ selects [] = Query::select ('$permissions ' , system: true );
2975+ }
2976+
29682977 $ context = new QueryContext ();
29692978 $ context ->add ($ collection );
29702979
@@ -3098,7 +3107,10 @@ public function getDocument(string $collection, string $id, array $queries = [],
30983107 // $id, $permissions and $collection are the default selected attributes for (MariaDB, MySQL, SQLite, Postgres)
30993108 // All internal attributes are default selected attributes for (MongoDB)
31003109 if (!empty ($ selects )) {
3101- $ selectedAttributes = array_map (fn ($ q ) => $ q ->getAttribute (), $ selects );
3110+ $ selectedAttributes = array_map (
3111+ fn ($ q ) => $ q ->getAttribute (),
3112+ array_filter ($ selects , fn ($ q ) => $ q ->isSystem () === false )
3113+ );
31023114
31033115 foreach ($ this ->getInternalAttributes () as $ internalAttribute ) {
31043116 if (!in_array ($ internalAttribute ['$id ' ], $ selectedAttributes , true )) {
@@ -5744,11 +5756,11 @@ public function find(string $collection, array $queries = [], string $forPermiss
57445756
57455757 //$filters = self::convertQueries($collection, $filters);
57465758
5747- // /** @var array<Query> $queries */
5748- // $queries = \array_merge(
5749- // $selects,
5750- // $filters
5751- // );
5759+ // /** @var array<Query> $queries */
5760+ // $queries = \array_merge(
5761+ // $selects,
5762+ // $filters
5763+ // );
57525764
57535765 $ selections = $ this ->validateSelections ($ collection , $ selects );
57545766 $ nestedSelections = [];
@@ -5781,48 +5793,48 @@ public function find(string $collection, array $queries = [], string $forPermiss
57815793
57825794 $ selects = \array_values ($ selects ); // Since we may unset above
57835795
5784- // foreach ($queries as $index => &$query) {
5785- // switch ($query->getMethod()) {
5786- // case Query::TYPE_SELECT:
5787- // $values = $query->getValues();
5788- // foreach ($values as $valueIndex => $value) {
5789- // if (\str_contains($value, '.')) {
5790- // // Shift the top level off the dot-path to pass the selection down the chain
5791- // // 'foo.bar.baz' becomes 'bar.baz'
5792- // $nestedSelections[] = Query::select([
5793- // \implode('.', \array_slice(\explode('.', $value), 1))
5794- // ]);
5795- //
5796- // $key = \explode('.', $value)[0];
5797- //
5798- // foreach ($relationships as $relationship) {
5799- // if ($relationship->getAttribute('key') === $key) {
5800- // switch ($relationship->getAttribute('options')['relationType']) {
5801- // case Database::RELATION_MANY_TO_MANY:
5802- // case Database::RELATION_ONE_TO_MANY:
5803- // unset($values[$valueIndex]);
5804- // break;
5805- //
5806- // case Database::RELATION_MANY_TO_ONE:
5807- // case Database::RELATION_ONE_TO_ONE:
5808- // $values[$valueIndex] = $key;
5809- // break;
5810- // }
5811- // }
5812- // }
5813- // }
5814- // }
5815- // $query->setValues(\array_values($values));
5816- // break;
5817- // default:
5818- // if (\str_contains($query->getAttribute(), '.')) {
5819- // unset($queries[$index]);
5820- // }
5821- // break;
5822- // }
5823- // }
5824- //
5825- // $queries = \array_values($queries);
5796+ // foreach ($queries as $index => &$query) {
5797+ // switch ($query->getMethod()) {
5798+ // case Query::TYPE_SELECT:
5799+ // $values = $query->getValues();
5800+ // foreach ($values as $valueIndex => $value) {
5801+ // if (\str_contains($value, '.')) {
5802+ // // Shift the top level off the dot-path to pass the selection down the chain
5803+ // // 'foo.bar.baz' becomes 'bar.baz'
5804+ // $nestedSelections[] = Query::select([
5805+ // \implode('.', \array_slice(\explode('.', $value), 1))
5806+ // ]);
5807+ //
5808+ // $key = \explode('.', $value)[0];
5809+ //
5810+ // foreach ($relationships as $relationship) {
5811+ // if ($relationship->getAttribute('key') === $key) {
5812+ // switch ($relationship->getAttribute('options')['relationType']) {
5813+ // case Database::RELATION_MANY_TO_MANY:
5814+ // case Database::RELATION_ONE_TO_MANY:
5815+ // unset($values[$valueIndex]);
5816+ // break;
5817+ //
5818+ // case Database::RELATION_MANY_TO_ONE:
5819+ // case Database::RELATION_ONE_TO_ONE:
5820+ // $values[$valueIndex] = $key;
5821+ // break;
5822+ // }
5823+ // }
5824+ // }
5825+ // }
5826+ // }
5827+ // $query->setValues(\array_values($values));
5828+ // break;
5829+ // default:
5830+ // if (\str_contains($query->getAttribute(), '.')) {
5831+ // unset($queries[$index]);
5832+ // }
5833+ // break;
5834+ // }
5835+ // }
5836+ //
5837+ // $queries = \array_values($queries);
58265838
58275839 $ results = $ this ->adapter ->find (
58285840 $ context ,
@@ -6267,7 +6279,7 @@ public function decodeV2(QueryContext $context, Document $document, array $selec
62676279 }
62686280 }
62696281
6270- $ new = new Document ;
6282+ $ new = new Document () ;
62716283
62726284 foreach ($ document as $ key => $ value ) {
62736285 $ alias = Query::DEFAULT_ALIAS ;
0 commit comments