Fix _discard leaking into SQL for multi-select enum filters (#3738)

When an enum filter is used in multi-select mode, _discard gets
submitted as a literal value on subsequent page loads, producing
invalid SQL like: WHERE (col IN ('_discard','val1','val2'))

Client-side: deselect _discard option when initializing multi-select.
Server-side: strip _discard from array values as defense-in-depth.

Author: tonekk

lib/rails_admin/abstract_model.rb

@@ -140,6 +140,10 @@ def initialize(column, type, value, operator)
       end
 
       def to_statement
+        if @value.is_a?(Array) && @value.include?('_discard')
+          @value = @value.reject { |v| v == '_discard' }
+          return if @value.empty?
+        end
         return if [@operator, @value].any? { |v| v == '_discard' }
 
         unary_operators[@operator] || unary_operators[@value] ||

spec/rails_admin/adapters/active_record_spec.rb

@@ -305,6 +305,11 @@ def build_statement(type, value, operator)
       end
     end
 
+    it "strips '_discard' from array values" do
+      expect(build_statement(:enum, ['_discard'], nil)).to be_nil
+      expect(build_statement(:enum, %w[_discard foo bar], nil)).to eq(['(field IN (?))', %w[foo bar]])
+    end
+
     describe 'string type queries' do
       it 'supports string type query' do
         expect(build_statement(:string, '', nil)).to be_nil

spec/rails_admin/adapters/mongoid_spec.rb

@@ -277,6 +277,11 @@ def parse_value(value)
       end
     end
 
+    it "strips '_discard' from array values" do
+      expect(@abstract_model.send(:build_statement, :name, :enum, ['_discard'], nil)).to be_nil
+      expect(@abstract_model.send(:build_statement, :name, :enum, %w[_discard foo bar], nil)).to eq(name: {'$in' => %w[foo bar]})
+    end
+
     it "supports '_blank' operator" do
       [['_blank', ''], ['', '_blank']].each do |value, operator|
         expect(@abstract_model.send(:build_statement, :name, :string, value, operator)).to eq(name: {'$in' => [nil, '']})

src/rails_admin/filter-box.js

@@ -102,7 +102,10 @@ import flatpickr from "flatpickr";
                 $(this).attr("selected", true);
             });
             if (multiple)
-              control.find("option[value^=_],option[disabled]").hide();
+              control
+                .find("option[value^=_],option[disabled]")
+                .hide()
+                .prop("selected", false);
           }
           break;
         case "citext":