Skip to content
This repository was archived by the owner on Jan 30, 2024. It is now read-only.

Commit 337be93

Browse files
committed
[-] Code Style - Improve the code from the latest submitted PR
1 parent 2bad5b9 commit 337be93

File tree

2 files changed

+7
-8
lines changed

2 files changed

+7
-8
lines changed

CHANGELOG.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
# Change Log
22

33
## [Unreleased]
4-
### Changed
5-
- Security - Avoid SQL Injection by escaping the search parameter when using active record escaping pattern.
4+
### Fixed
5+
- Search - Fix the search while typing single quotes in the search value.
66

77
## RELEASE 2.11.3 - 2018-07-30
88
### Fixed

app/services/forest_liana/search_query_builder.rb

+5-6
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ def initialize(params, includes, collection)
1313
end
1414

1515
def perform(resource)
16-
@search = @params[:search]
1716
@resource = @records = resource
1817
@records = search_param
1918
@records = filter_param
@@ -64,7 +63,7 @@ def search_param
6463
value = @search.to_i
6564
conditions << "#{@resource.table_name}.id = #{value}" if value > 0
6665
elsif REGEX_UUID.match(@search)
67-
conditions << "#{@resource.table_name}.id = :id_search"
66+
conditions << "#{@resource.table_name}.id = :search_value_for_uuid"
6867
end
6968
# NOTICE: Rails 3 do not have a defined_enums method
7069
elsif @resource.respond_to?(:defined_enums) &&
@@ -74,7 +73,7 @@ def search_param
7473
#{@resource.defined_enums[column.name][@search.downcase]}"
7574
elsif !(column.respond_to?(:array) && column.array) &&
7675
(column.type == :string || column.type == :text)
77-
conditions << "LOWER(#{column_name}) LIKE :like_search"
76+
conditions << "LOWER(#{column_name}) LIKE :search_value_for_string"
7877
end
7978
end
8079

@@ -140,8 +139,8 @@ def search_param
140139

141140
@records = @resource.where(
142141
conditions.join(' OR '),
143-
like_search: "%#{@search.downcase}%",
144-
id_search: @search.to_s
142+
search_value_for_string: "%#{@search.downcase}%",
143+
search_value_for_uuid: @search.to_s
145144
)
146145
end
147146

@@ -150,7 +149,7 @@ def search_param
150149

151150
def association_search_condition table_name, column_name
152151
column_name = format_column_name(table_name, column_name)
153-
"LOWER(#{column_name}) LIKE :like_search"
152+
"LOWER(#{column_name}) LIKE :search_value_for_string"
154153
end
155154

156155
def filter_param

0 commit comments

Comments
 (0)