zerp/form-builder v1.0.3

Security

• Validated sort and direction on the index screens. They ordered by a column and direction taken straight from the query string. Eloquent binds values but not identifiers, so the column name was interpolated into the SQL: a 500 on a bad column at best, an injection surface at worst. The column is now kept only if it is a real column on the model's table and the direction only if it is asc or desc, falling back to the order each screen already used when no sort was given.

Part of the platform-wide sweep tracked on zerp-pk/zerp#39.