harry
/
universal_table
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix security problem

This commit is contained in:
chiu 2020-04-29 13:29:13 +08:00
parent 1db53c8b06
commit 3842c713fa
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
app/controllers/universal_tables_controller.rb
View File

@ -10,9 +10,10 @@ class UniversalTablesController < ApplicationController
search = ""
sort_class = "sort"
sort = ""
form_field = "<input type='search' class='form-control' name='q' placeholder='Search keyword'>"
csrf_value = (0...46).map { ('a'..'z').to_a[rand(26)] }.join
form_field = "<input type=\"hidden\" name=\"authenticity_token\" value=\"#{csrf_value}\"><input type='search' class='form-control' name='q' placeholder='Search keyword'>"
query_string = ""
query_string = "&column=#{params["column"]}&q=#{params["q"]}" if params["column"].present?
query_string = "&column=#{params["column"].gsub("\"",'')}&q=#{params["q"].gsub("\"",'')}" if params["column"].present?
query_string = query_string + "&page_no=#{params["page_no"]}" if params["page_no"].present?
sort_url = "/#{I18n.locale.to_s}#{page.url}?sortcolumn=#{tc.key}&sort=asc#{query_string}"
title_class = ""
@ -31,7 +32,7 @@ class UniversalTablesController < ApplicationController
when "text"
if tc.make_categorizable
select_values = tc.column_entries.distinct(:text).uniq
form_field = "<select class='form-control' name='q'>"
form_field = "<input type=\"hidden\" name=\"authenticity_token\" value=\"#{csrf_value}\"><select class='form-control' name='q'>"
select_values.each do |sv|
form_field = form_field + "<option value='#{sv[I18n.locale.to_s]}'>#{sv[I18n.locale.to_s]}</option>"
end
@ -59,7 +60,7 @@ class UniversalTablesController < ApplicationController
"title-class" => title_class
}
end
tablecolumns = table.table_columns.where(:display_in_index => true).asc(:order)
tablecolum1ns = table.table_columns.where(:display_in_index => true).asc(:order)
rows = []
entries = get_entries(params, table, page)
total_pages = entries.total_pages