fix(spend): guard session_id filter against non-str query default

This commit is contained in:
Thibault Serot 2026-07-09 15:33:11 +10:00
parent f33403cb4b
commit 7801324ab0

View file

@ -1910,7 +1910,7 @@ async def ui_view_spend_logs(
p += 2
sql_conditions.append(or_clause)
if session_id is not None:
if session_id is not None and isinstance(session_id, str):
like_escaped_session_id = session_id.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")
sql_conditions.append(f"session_id LIKE ${p}")
sql_params.append(f"%{like_escaped_session_id}%")