search

leikind / wice_grid

A Rails grid plugin to create grids with sorting, pagination, and (automatically generated) filters
MIT License
536 stars 215 forks source link

[Rails5] Fixes for ActionDispatch::Routing::INSECURE_URL_PARAMETERS_MESSAGE #321

Closed harryPL closed 7 years ago

harryPL commented 7 years ago

While migrating my app to Rails 5 I encountered on ActionDispatch::Routing exception. This PR removes the deprecation warnings associated with the merge! method. It also removes the ActionDispatch::Routing exception. The exact message of the exception is "

Attempting to generate a URL from non-sanitized request parameters! An attacker can inject malicious data into the generated URL, such as changing the host. Whitelist and sanitize passed parameters to be secure."

The problem is present due to changes to ActionController::Parameters in Rails 5.

Excerpt from the framework calls

actionpack (5.0.0) lib/action_dispatch/routing/url_for.rb:176:in url_for' /home/pfurman/.rvm/gems/ruby-2.3.1@rails5/bundler/gems/wice_grid-f3d6c462af2b/lib/wice/grid_renderer.rb:550:inbase_link_for_filter' /home/pfurman/.rvm/gems/ruby-2.3.1@rails5/bundler/gems/wice_grid-f3d6c462af2b/lib/wice/helpers/wice_grid_view_helpers.rb:471:in grid_html' /home/pfurman/.rvm/gems/ruby-2.3.1@rails5/bundler/gems/wice_grid-f3d6c462af2b/lib/wice/helpers/wice_grid_view_helpers.rb:124:indefine_grid' actionview (5.0.0) lib/action_view/template.rb:158:in `block in render'

leikind commented 7 years ago

hi thanks there seem to be conflicts could you please resolve them?

harryPL commented 7 years ago

I don't have the write access to the cfiorini:rails5 branch. I'm going to make another PR from my own fork and resolve them there.