[PATCH conductor 2/7] sanatize :sort_by param directly passed into the :order param of User:all
Mo Morsi
mmorsi at redhat.com
Thu May 3 10:46:12 UTC 2012
---
src/app/controllers/application_controller.rb | 3 ++-
src/app/controllers/permissions_controller.rb | 2 +-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/src/app/controllers/application_controller.rb b/src/app/controllers/application_controller.rb
index 9b89d0e..98078e5 100644
--- a/src/app/controllers/application_controller.rb
+++ b/src/app/controllers/application_controller.rb
@@ -285,7 +285,8 @@ class ApplicationController < ActionController::Base
def sort_column(model, default = nil)
return params[:order_field] if model.column_names.include?(params[:order_field])
- return default || "#{model.quoted_table_name}.name"
+ return default unless default.nil? || !model.column_names.include?(default)
+ return "#{model.quoted_table_name}.name"
end
def sort_direction
diff --git a/src/app/controllers/permissions_controller.rb b/src/app/controllers/permissions_controller.rb
index 67ca3cd..9b27c39 100644
--- a/src/app/controllers/permissions_controller.rb
+++ b/src/app/controllers/permissions_controller.rb
@@ -170,7 +170,7 @@ class PermissionsController < ApplicationController
def load_users
sort_order = params[:sort_by].nil? ? "login" : params[:sort_by]
- @users = User.all(:order => sort_order)
+ @users = User.all(:order => sort_column(User, sort_order))
end
def load_headers
--
1.7.7.6
More information about the aeolus-devel
mailing list