4 ms·

I have some recollection about filters defined by jinja macros opening up for SQL injections.

• fifilura 3y ago
  And this would be fine if you could lock down arbitrary input in e.g. dropdowns, but it was still possible to input arbitrary strings even in a dropdown because of the choice of widget.