Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

Clean up policy query to use parameter binding for platform filter (#46604)

Browse Source 
## Summary
- Refactored the conditional access policy query to use `CONCAT('%', ?,
'%')` with a bound parameter instead of string concatenation for the
platform `LIKE` clause, consistent with how other queries in this file
handle string filters.

## Test plan
- [ ] Verify conditional access policy lookup still returns correct
results for macOS/Windows hosts.
- [ ] Confirm no regression in policy filtering behavior.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Improved platform filtering in conditional access policy queries to
enhance query reliability.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This commit is contained in:
Sharon Katz
2026-06-01 18:15:02 -04:00
committed by GitHub
parent 75e932e614
commit 7fb464abc4
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/datastore/mysql/policies.go
+2 -2
View File
@@ -2538,9 +2538,9 @@ func (ds *Datastore) GetCalendarPolicies(ctx context.Context, teamID uint) ([]fl
func (ds *Datastore) GetPoliciesForConditionalAccess(ctx context.Context, teamID uint, platform string) ([]uint, error) {
// Currently, the "Conditional access" feature is for macOS hosts only.
query := `SELECT id FROM policies WHERE team_id = ? AND conditional_access_enabled AND (platforms LIKE '%` + platform + `%' OR platforms = '');`
query := `SELECT id FROM policies WHERE team_id = ? AND conditional_access_enabled AND (platforms LIKE CONCAT('%', ?, '%') OR platforms = '');`
var policyIDs []uint
err := sqlx.SelectContext(ctx, ds.reader(ctx), &policyIDs, query, teamID)
err := sqlx.SelectContext(ctx, ds.reader(ctx), &policyIDs, query, teamID, platform)
if err != nil {
return nil, ctxerr.Wrap(ctx, err, "get policies for conditional access")
}