[PATCH conductor 01/11] sanitize :sort_by param directly passed into the :order param of User:all

Mo Morsi mmorsi at redhat.com
Thu Jun 21 20:51:49 UTC 2012


From: mmorsi <mmorsi at redhat.com>

---
 src/app/controllers/application_controller.rb |    3 ++-
 src/app/controllers/permissions_controller.rb |    3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/app/controllers/application_controller.rb b/src/app/controllers/application_controller.rb
index eb5931b..6b94efb 100644
--- a/src/app/controllers/application_controller.rb
+++ b/src/app/controllers/application_controller.rb
@@ -300,7 +300,8 @@ class ApplicationController < ActionController::Base
 
   def sort_column(model, default = nil)
     return params[:order_field] if model.column_names.include?(params[:order_field])
-    return default || "#{model.quoted_table_name}.name"
+    return default unless default.nil? || !model.column_names.include?(default)
+    return "#{model.quoted_table_name}.name"
   end
 
   def sort_direction
diff --git a/src/app/controllers/permissions_controller.rb b/src/app/controllers/permissions_controller.rb
index acdbb2c..d621e6d 100644
--- a/src/app/controllers/permissions_controller.rb
+++ b/src/app/controllers/permissions_controller.rb
@@ -169,7 +169,8 @@ class PermissionsController < ApplicationController
 
   def load_entities
     sort_order = params[:sort_by].nil? ? "name" : params[:sort_by]
-    @entities = paginate_collection(Entity.all(:order => sort_order), params[:page])
+    @entities = paginate_collection(Entity.all(:order => sort_column(Entity, sort_order)),
+                                    params[:page])
   end
 
   def load_headers
-- 
1.7.6.5




More information about the aeolus-devel mailing list