lino.jorzick
/
greenlight
forked from External/greenlight
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Sanitize search for users and rooms (#1784)

This commit is contained in:
Ahmad Farhat 2020-06-11 12:39:18 -04:00 committed by GitHub
parent cf794db595
commit 06236b49f7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
app/models/room.rb
View File

@ -40,8 +40,7 @@ class Room < ApplicationRecord
search_query = "rooms.name LIKE :search OR rooms.uid LIKE :search OR users.email LIKE :search" \ search_query = "rooms.name LIKE :search OR rooms.uid LIKE :search OR users.email LIKE :search" \
" OR users.#{created_at_query} LIKE :search" " OR users.#{created_at_query} LIKE :search"
search_param = "%#{string}%" search_param = "%#{sanitize_sql_like(string)}%"
where(search_query, search: search_param) where(search_query, search: search_param)
end end

4
app/models/user.rb
View File

@ -85,7 +85,7 @@ class User < ApplicationRecord
search_query = "users.name LIKE :search OR email LIKE :search OR username LIKE :search" \ search_query = "users.name LIKE :search OR email LIKE :search OR username LIKE :search" \
" OR users.#{created_at_query} LIKE :search OR users.provider LIKE :search" \ " OR users.#{created_at_query} LIKE :search OR users.provider LIKE :search" \
" OR roles.name LIKE :roles_search" " OR roles.name LIKE :roles_search"
role_search_param = "%#{string}%" role_search_param = "%#{sanitize_sql_like(string)}%"
else else
search_query = "(users.name LIKE :search OR email LIKE :search OR username LIKE :search" \ search_query = "(users.name LIKE :search OR email LIKE :search OR username LIKE :search" \
" OR users.#{created_at_query} LIKE :search OR users.provider LIKE :search)" \ " OR users.#{created_at_query} LIKE :search OR users.provider LIKE :search)" \
@ -93,7 +93,7 @@ class User < ApplicationRecord
role_search_param = role.name role_search_param = role.name
end end
search_param = "%#{string}%" search_param = "%#{sanitize_sql_like(string)}%"
where(search_query, search: search_param, roles_search: role_search_param) where(search_query, search: search_param, roles_search: role_search_param)
end end