search

stffn / declarative_authorization

An unmaintained authorization plugin for Rails. Please fork to support current versions of Rails
MIT License
1.24k stars 233 forks source link

removes harmful OR (1=1) #170

Closed bwlang closed 11 years ago

bwlang commented 11 years ago

This fixes a problem in which sql like this can be generated:

SELECT DISTINCT ON ("screening_projects".id) "screening_projects".id, screening_projects.display_order AS alias_0 FROM "screening_projects" LEFT OUTER JOIN "screening_project_roles" ON ("screening_projects"."id" = "screening_project_roles"."screening_project_id") LEFT OUTER JOIN "roles" ON ("roles"."id" = "screening_project_roles"."role_id") WHERE (("roles"."id" IN (3,4,5)) OR (1=1))

(note the extra 1=1 that emasculates the "id in..." subquery) in response to an if_attribute rule like this:

if_attribute :roles => intersects_with {user.roles}  

bwlang commented 11 years ago

This is a misdiagnosis... sorry for the noise!

neilbilly commented 10 years ago

Hi, I'm experiencing this problem right now (i.e. the 1=1 in the query) ... what was the deal with this? Should we just write out rules an a certain way to avoid it?