sanitize search query

2026-08-09 16:01:12 +03:00
parent f35510ffd6
commit c59c470321
2 changed files with 3 additions and 2 deletions
@@ -36,7 +36,7 @@ class SubmittersAutocompleteController < ApplicationController
      else
        column = Submitter.arel_table[field.to_sym]

-        term = "#{params[:q].downcase}%"
+        term = "#{ActiveRecord::Base.sanitize_sql_like(params[:q].downcase)}%"

        submitters.where(column.matches(term))
      end