Closed evan-duncan closed 5 years ago
The wiki page for filters includes examples that will open up users to SQL injection.
# easy use case: filter(:name, :string) { |value| where("name ilike '%#{value}%'") }
You should update all example queries that are not properly sanitizing inputs so users less familiar with active record won't do bad things.
# easy use case: filter(:name, :string) { |value| where("name ilike ?", "%#{value}%") }
Good suggestion, btw, you can update that too.
The wiki page for filters includes examples that will open up users to SQL injection.
You should update all example queries that are not properly sanitizing inputs so users less familiar with active record won't do bad things.