From dbbbf5b9bd9ef92429c41316e405473a4994f70c Mon Sep 17 00:00:00 2001 From: StephenCWills Date: Thu, 8 Oct 2026 15:53:49 -0400 Subject: [PATCH 1/2] Use parameterized SQL queries in DataHub methods --- Source/Applications/openPDC/openPDC/DataHub.cs | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/Source/Applications/openPDC/openPDC/DataHub.cs b/Source/Applications/openPDC/openPDC/DataHub.cs index 645a8d69f6..0c0527f51f 100644 --- a/Source/Applications/openPDC/openPDC/DataHub.cs +++ b/Source/Applications/openPDC/openPDC/DataHub.cs @@ -271,14 +271,16 @@ public void RemoveDeviceCalculations(int deviceID) Device device = QueryDeviceByID(deviceID); if (device is null || device.ID == 0) return; - DataContext.Connection.ExecuteNonQuery($"DELETE FROM CustomActionAdapter WHERE TypeName = 'DynamicCalculator.DynamicCalculator' AND AdapterName LIKE '{device.Acronym}%'"); - DataContext.Connection.ExecuteNonQuery($"DELETE FROM Measurement WHERE DeviceID = {device.ID} AND SignalTypeID = {CalcSignalTypeID}"); + + string searchText = $"{device.Acronym}%"; + DataContext.Connection.ExecuteNonQuery("DELETE FROM CustomActionAdapter WHERE TypeName = 'DynamicCalculator.DynamicCalculator' AND AdapterName LIKE {0}", searchText); + DataContext.Connection.ExecuteNonQuery("DELETE FROM Measurement WHERE DeviceID = {0} AND SignalTypeID = {1}", device.ID, CalcSignalTypeID); } public void RemoveAllDeviceCalculations() { DataContext.Connection.ExecuteNonQuery("DELETE FROM CustomActionAdapter WHERE TypeName = 'DynamicCalculator.DynamicCalculator'"); - DataContext.Connection.ExecuteNonQuery($"DELETE FROM Measurement WHERE SignalTypeID = {CalcSignalTypeID}"); + DataContext.Connection.ExecuteNonQuery("DELETE FROM Measurement WHERE SignalTypeID = {0}", CalcSignalTypeID); } #endregion From f4a4e276d11db67a7b3d503bdf4fe8b85b5c4f7b Mon Sep 17 00:00:00 2001 From: StephenCWills Date: Thu, 8 Oct 2026 16:15:40 -0400 Subject: [PATCH 2/2] Apply hub role authorization attributes to DataHub methods for bulk tag updates --- Source/Applications/openPDC/openPDC/DataHub.cs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Source/Applications/openPDC/openPDC/DataHub.cs b/Source/Applications/openPDC/openPDC/DataHub.cs index 0c0527f51f..5ffd550ac9 100644 --- a/Source/Applications/openPDC/openPDC/DataHub.cs +++ b/Source/Applications/openPDC/openPDC/DataHub.cs @@ -266,6 +266,7 @@ public void AddNewOrUpdateDevice(Device device) DataContext.Table().AddNewOrUpdateRecord(device); } + [AuthorizeHubRole("Administrator, Editor")] public void RemoveDeviceCalculations(int deviceID) { Device device = QueryDeviceByID(deviceID); @@ -277,6 +278,7 @@ public void RemoveDeviceCalculations(int deviceID) DataContext.Connection.ExecuteNonQuery("DELETE FROM Measurement WHERE DeviceID = {0} AND SignalTypeID = {1}", device.ID, CalcSignalTypeID); } + [AuthorizeHubRole("Administrator, Editor")] public void RemoveAllDeviceCalculations() { DataContext.Connection.ExecuteNonQuery("DELETE FROM CustomActionAdapter WHERE TypeName = 'DynamicCalculator.DynamicCalculator'");