From b970f0cb0c6799b75f94df19814d6b1fe79f1d73 Mon Sep 17 00:00:00 2001
From: callebtc <93376500+callebtc@users.noreply.github.com>
Date: Fri, 25 Nov 2022 15:11:58 +0100
Subject: [PATCH] rewrite values in db

---
 lnbits/db.py | 37 ++++++++++++++++++++++++-------------
 1 file changed, 24 insertions(+), 13 deletions(-)

diff --git a/lnbits/db.py b/lnbits/db.py
index 7d15a304..e67cc22e 100644
--- a/lnbits/db.py
+++ b/lnbits/db.py
@@ -72,30 +72,41 @@ class Connection(Compat):
         if self.type in {POSTGRES, COCKROACH}:
             query = query.replace("%", "%%")
             query = query.replace("?", "%s")
-
-            # strip html
-            CLEANR = re.compile("<.*?>|&([a-z0-9]+|#[0-9]{1,6}|#x[0-9a-f]{1,6});")
-
-            def cleanhtml(raw_html):
-                cleantext = re.sub(CLEANR, "", raw_html)
-                return cleantext
-
-            query = cleanhtml(query)
-
         return query
 
+    def rewrite_values(self, values):
+        # strip html
+        CLEANR = re.compile("<.*?>|&([a-z0-9]+|#[0-9]{1,6}|#x[0-9a-f]{1,6});")
+
+        def cleanhtml(raw_html):
+            if type(raw_html) == str:
+                cleantext = re.sub(CLEANR, "", raw_html)
+                return cleantext
+            else:
+                return raw_html
+
+        # tuple to list and back to tuple
+        values = tuple([cleanhtml(l) for l in list(values)])
+        return values
+
     async def fetchall(self, query: str, values: tuple = ()) -> list:
-        result = await self.conn.execute(self.rewrite_query(query), values)
+        result = await self.conn.execute(
+            self.rewrite_query(query), self.rewrite_values(values)
+        )
         return await result.fetchall()
 
     async def fetchone(self, query: str, values: tuple = ()):
-        result = await self.conn.execute(self.rewrite_query(query), values)
+        result = await self.conn.execute(
+            self.rewrite_query(query), self.rewrite_values(values)
+        )
         row = await result.fetchone()
         await result.close()
         return row
 
     async def execute(self, query: str, values: tuple = ()):
-        return await self.conn.execute(self.rewrite_query(query), values)
+        return await self.conn.execute(
+            self.rewrite_query(query), self.rewrite_values(values)
+        )
 
 
 class Database(Compat):