escape wildcard query

2026-02-14 11:05:05 +02:00
parent 680ab9dbed
commit 34ea639c25
3 changed files with 9 additions and 4 deletions
@@ -20,7 +20,9 @@ module TemplateFolders
  def search(folders, keyword)
    return folders if keyword.blank?

-    folders.where(TemplateFolder.arel_table[:name].lower.matches("%#{keyword.downcase}%"))
+    sanitized = ActiveRecord::Base.sanitize_sql_like(keyword.downcase)
+
+    folders.where(TemplateFolder.arel_table[:name].lower.matches("%#{sanitized}%"))
  end

  def filter_active_folders(template_folders, templates)