From bd900d0b48fe37a98def4c0e094e39e7e385e9ea Mon Sep 17 00:00:00 2001 From: Yuri Kuznetsov Date: Wed, 19 Mar 2025 14:29:22 +0200 Subject: [PATCH 1/2] disable order --- application/Espo/Core/ORM/Type/FieldType.php | 1 + application/Espo/Core/Select/Order/Applier.php | 4 ++++ application/Espo/Resources/metadata/entityDefs/User.json | 3 ++- 3 files changed, 7 insertions(+), 1 deletion(-) diff --git a/application/Espo/Core/ORM/Type/FieldType.php b/application/Espo/Core/ORM/Type/FieldType.php index 1e28e439a8..01d5216022 100644 --- a/application/Espo/Core/ORM/Type/FieldType.php +++ b/application/Espo/Core/ORM/Type/FieldType.php @@ -63,4 +63,5 @@ class FieldType public const WYSIWYG = 'wysiwyg'; public const JSON_ARRAY = 'jsonArray'; public const JSON_OBJECT = 'jsonObject'; + public const PASSWORD = 'password'; } diff --git a/application/Espo/Core/Select/Order/Applier.php b/application/Espo/Core/Select/Order/Applier.php index da93aa0b19..70d258fc82 100644 --- a/application/Espo/Core/Select/Order/Applier.php +++ b/application/Espo/Core/Select/Order/Applier.php @@ -76,6 +76,10 @@ class Applier if ($this->metadataProvider->isFieldOrderDisabled($this->entityType, $orderBy)) { throw new Forbidden("Order by the field '$orderBy' is disabled."); } + + if ($this->metadataProvider->getFieldType($this->entityType, $orderBy) === FieldType::PASSWORD) { + throw new Forbidden("Order by field '$orderBy' is not allowed."); + } } if ($orderBy === null) { diff --git a/application/Espo/Resources/metadata/entityDefs/User.json b/application/Espo/Resources/metadata/entityDefs/User.json index 101b6f0a9e..4d28de81ad 100644 --- a/application/Espo/Resources/metadata/entityDefs/User.json +++ b/application/Espo/Resources/metadata/entityDefs/User.json @@ -45,7 +45,8 @@ "directAccessDisabled": true, "fieldManagerParamList": [ "tooltipText" - ] + ], + "orderDisabled": true }, "passwordConfirm": { "type": "password", From 91740192d2e2c575c6a04534c079baf9f3af0a7f Mon Sep 17 00:00:00 2001 From: Yuri Kuznetsov Date: Wed, 19 Mar 2025 14:30:49 +0200 Subject: [PATCH 2/2] order disabled api key --- application/Espo/Resources/metadata/entityDefs/User.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/application/Espo/Resources/metadata/entityDefs/User.json b/application/Espo/Resources/metadata/entityDefs/User.json index 4d28de81ad..c46fccb583 100644 --- a/application/Espo/Resources/metadata/entityDefs/User.json +++ b/application/Espo/Resources/metadata/entityDefs/User.json @@ -82,7 +82,8 @@ "tooltipText" ], "copyToClipboard": true, - "dynamicLogicVisibleDisabled": true + "dynamicLogicVisibleDisabled": true, + "orderDisabled": true }, "secretKey": { "type": "varchar",