graphql: fix password rewriting (hypermodeinc#5256)

dna2fork · Jul 18, 2020 · 459eb0e · 459eb0e
1 parent f9a6330
commit 459eb0e
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 7 deletions.
diff --git a/graphql/resolve/query_rewriter.go b/graphql/resolve/query_rewriter.go
@@ -57,8 +57,6 @@ func (qr *queryRewriter) Rewrite(ctx context.Context,
 		}
 
 		dgQuery := rewriteAsGet(gqlQuery, uid, xid)
-		addTypeFilter(dgQuery, gqlQuery.Type())
-
 		return dgQuery, nil
 
 	case schema.FilterQuery:
@@ -201,8 +199,12 @@ func addArgumentsToField(dgQuery *gql.GraphQuery, field schema.Field) {
 }
 
 func rewriteAsGet(field schema.Field, uid uint64, xid *string) *gql.GraphQuery {
+	var dgQuery *gql.GraphQuery
+
 	if xid == nil {
-		return rewriteAsQueryByIds(field, []uint64{uid})
+		dgQuery = rewriteAsQueryByIds(field, []uint64{uid})
+		addTypeFilter(dgQuery, field.Type())
+		return dgQuery
 	}
 
 	xidArgName := field.XIDArg()
@@ -214,7 +216,6 @@ func rewriteAsGet(field schema.Field, uid uint64, xid *string) *gql.GraphQuery {
 		},
 	}
 
-	var dgQuery *gql.GraphQuery
 	if uid > 0 {
 		dgQuery = &gql.GraphQuery{
 			Attr: field.ResponseName(),
@@ -235,6 +236,7 @@ func rewriteAsGet(field schema.Field, uid uint64, xid *string) *gql.GraphQuery {
 	}
 	addSelectionSetFrom(dgQuery, field)
 	addUID(dgQuery)
+	addTypeFilter(dgQuery, field.Type())
 	return dgQuery
 }
 

diff --git a/graphql/resolve/query_test.yaml b/graphql/resolve/query_test.yaml
@@ -1146,17 +1146,17 @@
   name: "Password query"
   gqlquery: |
     query {
-      checkUserPassword(name: "0x1", pwd: "Password") {
+      checkUserPassword(name: "user1", pwd: "Password") {
         name
       }
     }
   dgquery: |-
     query {
-      checkUserPassword(func: eq(User.name, "0x1")) @filter((eq(val(pwd), 1))) {
+      checkUserPassword(func: eq(User.name, "user1")) @filter((eq(val(pwd), 1) AND type(User))) {
         name : User.name
         dgraph.uid : uid
       }
-      checkPwd(func: eq(User.name, "0x1")) {
+      checkPwd(func: eq(User.name, "user1")) @filter(type(User)) {
         pwd as checkpwd(User.pwd, "Password")
       }
     }