didadmin/docuseal
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix brakeman SQL injection warning

Browse Source
This commit is contained in:
Alex Turchyn
2026-03-01 16:14:15 +02:00
committed by GitHub
parent 65491936c3
commit ab9008b3be
1 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/controllers/submitters_autocomplete_controller.rb
+9 -7
View File
@@ -7,13 +7,15 @@ class SubmittersAutocompleteController < ApplicationController
LIMIT = 100
def index
submitters = search_submitters(@submitters)
field = SELECT_COLUMNS.find { |c| c == params[:field] }
submitters = search_submitters(@submitters, field)
arel_columns = SELECT_COLUMNS.map { |col| Submitter.arel_table[col] }
values =
if params[:field].present? && SELECT_COLUMNS.include?(params[:field])
max_ids = submitters.group(params[:field]).limit(LIMIT).select(Submitter.arel_table[:id].maximum)
if field
max_ids = submitters.group(field).limit(LIMIT).select(Submitter.arel_table[:id].maximum)
submitters.where(id: max_ids).order(id: :desc).pluck(arel_columns)
else
@@ -27,12 +29,12 @@ class SubmittersAutocompleteController < ApplicationController
private
def search_submitters(submitters)
if SELECT_COLUMNS.include?(params[:field])
def search_submitters(submitters, field)
if field
if Docuseal.fulltext_search?
Submitters.fulltext_search_field(current_user, submitters, params[:q], params[:field])
Submitters.fulltext_search_field(current_user, submitters, params[:q], field)
else
column = Submitter.arel_table[params[:field].to_sym]
column = Submitter.arel_table[field.to_sym]
term = "#{params[:q].downcase}%"