Fix AC::Parameters not being sanitized for query methods. #21539
Conversation
|
(@rails-bot has picked a reviewer for you, use r? to override) |
tgxworld
force-pushed
the
parameters_not_sanitized
branch
from
e32fddd
to
5bcde95
Compare
| @@ -42,6 +42,7 @@ def initialize(scope) | |||
| # User.where.not(name: "Jon", role: "admin") | |||
| # # SELECT * FROM users WHERE name != 'Jon' AND role != 'admin' | |||
| def not(opts, *rest) | |||
| opts = @scope.send(:sanitize_opts, opts) | |||
There was a problem hiding this comment.
We only need to do it on where!
There was a problem hiding this comment.
hmm we can't. where! is not called if it is called the following way: where.not(params).
There was a problem hiding this comment.
where.not don't need to be sanitized, only where
There was a problem hiding this comment.
Why does where.not need not be sanitized? 💭
There was a problem hiding this comment.
Because the arguments passed to where.not are not used to initialize the object when you do where.not(admin: true).first_or_create
|
r+ @rails-bot |
|
r+ @schneems. This pull request was approved by one of the reviewers and it is waiting your decision |
|
Ah I forgot about this. Let me get it sorted by this weekend. @rafaelfranca |
tgxworld
force-pushed
the
parameters_not_sanitized
branch
from
5bcde95
to
7d0b1e4
Compare
|
@rafaelfranca Updated |
Fix AC::Parameters not being sanitized for query methods.
|
❤️ 💚 💙 💛 💜 |
Actually do we need to sanitize inputs for query methods?