From 1038d25abdc2c4ba480744c08683501b8c917cf7 Mon Sep 17 00:00:00 2001 From: richjohnrambo Date: Wed, 16 Sep 2026 13:23:53 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E5=90=8E=E5=8F=B0=E6=B6=88=E6=81=AF?= =?UTF-8?q?=E6=9F=A5=E8=AF=A2=E6=8C=89=E5=AD=97=E7=AC=A6=E4=B8=B2=E8=BF=94?= =?UTF-8?q?=E5=9B=9E=E7=94=A8=E6=88=B7ID?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- server/auth_audit_test.go | 6 ++++++ server/internal_admin_query_resources.go | 6 +++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/server/auth_audit_test.go b/server/auth_audit_test.go index bcee600..5ea0890 100644 --- a/server/auth_audit_test.go +++ b/server/auth_audit_test.go @@ -75,6 +75,12 @@ func TestMessageQuerySpecsExposeAdminFields(t *testing.T) { if strings.Contains(strings.ToLower(privateSpec.Select), "m.content as content") || strings.Contains(strings.ToLower(groupSpec.Select), "m.content as content") { t.Fatal("message list query must not expose full message content") } + if !strings.Contains(privateSpec.Select, "CAST(m.`from` AS CHAR) AS from_user_id") || !strings.Contains(privateSpec.Select, "CAST(rs.userid AS CHAR) AS to_user_id") { + t.Fatal("private message query must expose 64-bit user IDs as strings") + } + if !strings.Contains(groupSpec.Select, "CAST(m.from_user AS CHAR) AS from_user_id") { + t.Fatal("group message query must expose 64-bit user IDs as strings") + } } func TestGroupMessageQuerySupportsOperationalFilters(t *testing.T) { diff --git a/server/internal_admin_query_resources.go b/server/internal_admin_query_resources.go index 1cb9070..65d724b 100644 --- a/server/internal_admin_query_resources.go +++ b/server/internal_admin_query_resources.go @@ -305,9 +305,9 @@ func privateMessagesInternalQuerySpec() *internalQuerySpec { contentExcerpt := `LEFT(COALESCE(NULLIF(JSON_UNQUOTE(JSON_EXTRACT(m.content,'$.txt')),''),CASE JSON_TYPE(m.content) WHEN 'STRING' THEN JSON_UNQUOTE(m.content) ELSE CONCAT('[',` + contentType + `,']') END,''),500)` status := `CASE WHEN aa.action='delete' THEN 'deleted' WHEN aa.action='hide' THEN 'hidden' WHEN m.recalled_at IS NOT NULL THEN 'recalled' WHEN m.deletedat IS NOT NULL THEN 'deleted' ELSE 'normal' END` return &internalQuerySpec{ - Select: `SELECT m.topic,m.seqid AS seq_id,m.` + "`from`" + ` AS from_user_id, + Select: `SELECT m.topic,m.seqid AS seq_id,CAST(m.` + "`from`" + ` AS CHAR) AS from_user_id, COALESCE(su.username,'') AS sender_username,COALESCE(sp.nickname,'') AS sender_nickname, - rs.userid AS to_user_id,COALESCE(ru.username,'') AS receiver_username,COALESCE(rp.nickname,'') AS receiver_nickname, + CAST(rs.userid AS CHAR) AS to_user_id,COALESCE(ru.username,'') AS receiver_username,COALESCE(rp.nickname,'') AS receiver_nickname, ` + contentType + ` AS content_type,` + contentExcerpt + ` AS content_excerpt, ` + status + ` AS status,m.createdat AS created_at,m.updatedat AS updated_at`, From: `FROM (SELECT * FROM im_messages WHERE topic LIKE 'p2p%') AS m @@ -327,7 +327,7 @@ func groupMessagesInternalQuerySpec() *internalQuerySpec { contentType := `CASE m.msg_type WHEN 'call' THEN 'system' WHEN 'system_notice' THEN 'system' WHEN 'contact_card' THEN 'card' WHEN 'forward_bundle' THEN 'card' WHEN 'link' THEN 'text' ELSE m.msg_type END` contentExcerpt := `LEFT(COALESCE(NULLIF(JSON_UNQUOTE(JSON_EXTRACT(m.content,'$.txt')),''),CASE JSON_TYPE(m.content) WHEN 'STRING' THEN JSON_UNQUOTE(m.content) ELSE CONCAT('[',` + contentType + `,']') END,''),500)` return &internalQuerySpec{ - Select: `SELECT m.topic,m.seqid AS seq_id,m.from_user AS from_user_id, + Select: `SELECT m.topic,m.seqid AS seq_id,CAST(m.from_user AS CHAR) AS from_user_id, COALESCE(u.username,'') AS sender_username,COALESCE(p.nickname,'') AS sender_nickname, COALESCE(gs.name,'') AS group_name,m.topic AS group_no,` + contentType + ` AS content_type, ` + contentExcerpt + ` AS content_excerpt,