From c1c099a6af8b0f6b61c8e8f4b78be7f15ff18c69 Mon Sep 17 00:00:00 2001
From: bohung <bohung@rulingcom.com>
Date: Mon, 24 Oct 2022 16:09:16 +0800
Subject: [PATCH] Fix vulnerable.

---
 app/controllers/admin/projects_controller.rb    |  4 ++--
 app/controllers/personal_projects_controller.rb | 11 ++++++++---
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/app/controllers/admin/projects_controller.rb b/app/controllers/admin/projects_controller.rb
index 46af582..a42813c 100644
--- a/app/controllers/admin/projects_controller.rb
+++ b/app/controllers/admin/projects_controller.rb
@@ -52,7 +52,7 @@ class Admin::ProjectsController < OrbitMemberController
   end
 
   def new
-    @member = Array(MemberProfile.find_by(:uid=>params['uid'])) rescue nil
+    @member = Array(MemberProfile.find_by(:uid=>params['uid'].to_s)) rescue nil
     @project = Project.new
     if params[:desktop]
       render :layout => false
@@ -203,7 +203,7 @@ class Admin::ProjectsController < OrbitMemberController
   end
 
   def frontend_setting
-    @member = MemberProfile.find_by(:uid=>params['uid']) rescue nil
+    @member = MemberProfile.find_by(:uid=>params['uid'].to_s) rescue nil
     @intro = ProjectIntro.find_by(:member_profile_id=>@member.id) rescue nil
     @intro = @intro.nil? ? ProjectIntro.new({:member_profile_id=>@member.id}) : @intro
   end
diff --git a/app/controllers/personal_projects_controller.rb b/app/controllers/personal_projects_controller.rb
index 71b6688..e19f608 100644
--- a/app/controllers/personal_projects_controller.rb
+++ b/app/controllers/personal_projects_controller.rb
@@ -34,7 +34,11 @@ class PersonalProjectsController < ApplicationController
       when 'note'
         projects_show = projects_temp.select { |value| search_all_words(Nokogiri::HTML(value.note).text, params[:keywords]) }
       else
-        projects_show = projects_temp.select { |value| search_all_words(value.send(params[:selectbox]).to_s, params[:keywords]) }
+        if fields_to_show.include?(params[:selectbox])
+          projects_show = projects_temp.select { |value| search_all_words(value.send(params[:selectbox]).to_s, params[:keywords]) }
+        else
+          projects_show = projects_temp
+        end
       end
       page_to_show = params[:page_no].nil? ? 1 : params[:page_no].to_i
       projects = projects_show[(page_to_show - 1) * page_data_count...page_to_show * page_data_count]
@@ -88,7 +92,8 @@ class PersonalProjectsController < ApplicationController
     choice = choice.map { |value| value.inject :merge }
     select_text = t('personal_project.search_class')
     search_text = t('personal_project.word_to_search')
-    csrf_value = (0...46).map { ('a'..'z').to_a[rand(26)] }.join
+    @_request = OrbitHelper.request
+    csrf_value = form_authenticity_token
     {
       'projects' => project_list,
       'headers' => headers,
@@ -105,7 +110,7 @@ class PersonalProjectsController < ApplicationController
 
   def show
     params = OrbitHelper.params
-    plugin = Project.where(is_hidden: false).find_by(uid: params[:uid])
+    plugin = Project.where(is_hidden: false).find_by(uid: params[:uid].to_s)
     fields_to_show = %w[
       year
       project_type