harry
/
universal_table
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix security problem

This commit is contained in:
chiu 2020-04-29 13:29:13 +08:00
parent 1db53c8b06
commit 3842c713fa
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
app/controllers/universal_tables_controller.rb
View File

@ -10,9 +10,10 @@ class UniversalTablesController < ApplicationController
search = "" search = ""
sort_class = "sort" sort_class = "sort"
sort = "" sort = ""
form_field = "<input type='search' class='form-control' name='q' placeholder='Search keyword'>" csrf_value = (0...46).map { ('a'..'z').to_a[rand(26)] }.join
form_field = "<input type=\"hidden\" name=\"authenticity_token\" value=\"#{csrf_value}\"><input type='search' class='form-control' name='q' placeholder='Search keyword'>"
query_string = "" query_string = ""
query_string = "&column=#{params["column"]}&q=#{params["q"]}" if params["column"].present? query_string = "&column=#{params["column"].gsub("\"",'')}&q=#{params["q"].gsub("\"",'')}" if params["column"].present?
query_string = query_string + "&page_no=#{params["page_no"]}" if params["page_no"].present? query_string = query_string + "&page_no=#{params["page_no"]}" if params["page_no"].present?
sort_url = "/#{I18n.locale.to_s}#{page.url}?sortcolumn=#{tc.key}&sort=asc#{query_string}" sort_url = "/#{I18n.locale.to_s}#{page.url}?sortcolumn=#{tc.key}&sort=asc#{query_string}"
title_class = "" title_class = ""
@ -31,7 +32,7 @@ class UniversalTablesController < ApplicationController
when "text" when "text"
if tc.make_categorizable if tc.make_categorizable
select_values = tc.column_entries.distinct(:text).uniq select_values = tc.column_entries.distinct(:text).uniq
form_field = "<select class='form-control' name='q'>" form_field = "<input type=\"hidden\" name=\"authenticity_token\" value=\"#{csrf_value}\"><select class='form-control' name='q'>"
select_values.each do |sv| select_values.each do |sv|
form_field = form_field + "<option value='#{sv[I18n.locale.to_s]}'>#{sv[I18n.locale.to_s]}</option>" form_field = form_field + "<option value='#{sv[I18n.locale.to_s]}'>#{sv[I18n.locale.to_s]}</option>"
end end
@ -59,7 +60,7 @@ class UniversalTablesController < ApplicationController
"title-class" => title_class "title-class" => title_class
} }
end end
tablecolumns = table.table_columns.where(:display_in_index => true).asc(:order) tablecolum1ns = table.table_columns.where(:display_in_index => true).asc(:order)
rows = [] rows = []
entries = get_entries(params, table, page) entries = get_entries(params, table, page)
total_pages = entries.total_pages total_pages = entries.total_pages