From cb8acf3f8c60a3a8418472ae35faa6a770b44e6c Mon Sep 17 00:00:00 2001
From: bohung <bohung@rulingcom.com>
Date: Mon, 24 Oct 2022 16:23:41 +0800
Subject: [PATCH] Fix vulnerable.

---
 app/controllers/admin/books_controller.rb    |  4 ++--
 app/controllers/personal_books_controller.rb | 11 ++++++++---
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/app/controllers/admin/books_controller.rb b/app/controllers/admin/books_controller.rb
index 46ec24d..9c0070c 100644
--- a/app/controllers/admin/books_controller.rb
+++ b/app/controllers/admin/books_controller.rb
@@ -107,7 +107,7 @@ class Admin::BooksController < OrbitMemberController
 
   def new
     @book = Book.new
-    @member = Array(MemberProfile.find_by(:uid=>params['uid'])) rescue nil
+    @member = Array(MemberProfile.find_by(:uid=>params['uid'].to_s)) rescue nil
     if params[:desktop]
       render :layout => false
     end
@@ -213,7 +213,7 @@ class Admin::BooksController < OrbitMemberController
   end
 
   def frontend_setting
-    @member = MemberProfile.find_by(:uid=>params['uid']) rescue nil
+    @member = MemberProfile.find_by(:uid=>params['uid'].to_s) rescue nil
     @intro = BookIntro.find_by(:member_profile_id=>@member.id) rescue nil
     @intro = @intro.nil? ? BookIntro.new({:member_profile_id=>@member.id}) : @intro
   end
diff --git a/app/controllers/personal_books_controller.rb b/app/controllers/personal_books_controller.rb
index 2a06965..80a22be 100644
--- a/app/controllers/personal_books_controller.rb
+++ b/app/controllers/personal_books_controller.rb
@@ -51,7 +51,11 @@ class PersonalBooksController < ApplicationController
       when 'note'
         books_show = books_temp.select { |value| search_all_words(Nokogiri::HTML(value.note).text, params[:keywords]) }
       else
-        books_show = books_temp.select { |value| search_all_words(value.send(params[:selectbox]).to_s, params[:keywords]) }
+        if fields_to_show.include?(params[:selectbox])
+          books_show = books_temp.select { |value| search_all_words(value.send(params[:selectbox]).to_s, params[:keywords]) }
+        else
+          books_show = books_temp
+        end
       end
       page_to_show = params[:page_no].nil? ? 1 : params[:page_no].to_i
       books = books_show[(page_to_show - 1) * page_data_count...page_to_show * page_data_count]
@@ -111,7 +115,8 @@ class PersonalBooksController < ApplicationController
     choice = choice.map { |value| value.inject :merge }
     select_text = t('personal_book.search_class')
     search_text = t('personal_book.word_to_search')
-    csrf_value = (0...46).map { ('a'..'z').to_a[rand(26)] }.join
+    @_request = OrbitHelper.request
+    csrf_value = form_authenticity_token
     {
       'book_list' => book_list,
       'extras' => { 'widget-title' => t('module_name.book'),
@@ -128,7 +133,7 @@ class PersonalBooksController < ApplicationController
 
   def show
     params = OrbitHelper.params
-    plugin = Book.where(is_hidden: false).find_by(uid: params[:uid])
+    plugin = Book.where(is_hidden: false).find_by(uid: params[:uid].to_s)
     fields_to_show = %w[
       year
       book_title