[PATCH conductor 2/7] sanatize :sort_by param directly passed into the :order param of User:all

Mo Morsi mmorsi at redhat.com
Thu May 3 10:46:12 UTC 2012


---
 src/app/controllers/application_controller.rb |    3 ++-
 src/app/controllers/permissions_controller.rb |    2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/app/controllers/application_controller.rb b/src/app/controllers/application_controller.rb
index 9b89d0e..98078e5 100644
--- a/src/app/controllers/application_controller.rb
+++ b/src/app/controllers/application_controller.rb
@@ -285,7 +285,8 @@ class ApplicationController < ActionController::Base
 
   def sort_column(model, default = nil)
     return params[:order_field] if model.column_names.include?(params[:order_field])
-    return default || "#{model.quoted_table_name}.name"
+    return default unless default.nil? || !model.column_names.include?(default)
+    return "#{model.quoted_table_name}.name"
   end
 
   def sort_direction
diff --git a/src/app/controllers/permissions_controller.rb b/src/app/controllers/permissions_controller.rb
index 67ca3cd..9b27c39 100644
--- a/src/app/controllers/permissions_controller.rb
+++ b/src/app/controllers/permissions_controller.rb
@@ -170,7 +170,7 @@ class PermissionsController < ApplicationController
 
   def load_users
     sort_order = params[:sort_by].nil? ? "login" : params[:sort_by]
-    @users = User.all(:order => sort_order)
+    @users = User.all(:order => sort_column(User, sort_order))
   end
 
   def load_headers
-- 
1.7.7.6




More information about the aeolus-devel mailing list