DGNum/demarches-normaliennes
13
1
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity

Fix SQL injections

Browse source
This commit is contained in:
Mathieu Magnin 2017-07-20 14:51:57 +02:00
parent e19410ed75
commit ed11ee4fb4
3 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
app/controllers/admin/accompagnateurs_controller.rb
View file

@ -12,7 +12,7 @@ class Admin::AccompagnateursController < AdminController
array: true
not_assign_scope = current_administrateur.gestionnaires.where.not(id: assign_scope.ids)
not_assign_scope = not_assign_scope.where("email LIKE '%#{params[:filter]}%'") if params[:filter]
not_assign_scope = not_assign_scope.where("email LIKE ?", "%#{params[:filter]}%") if params[:filter]
@accompagnateurs_not_assign = smart_listing_create :accompagnateurs_not_assign,
not_assign_scope,

2
app/controllers/admin/procedures_controller.rb
View file

@ -192,7 +192,7 @@ class Admin::ProceduresController < AdminController
.joins(', procedures')
.where("procedures.id = procedure_paths.procedure_id")
.where("procedures.archived_at" => nil)
.where("path LIKE '%#{params[:request]}%'")
.where("path LIKE ?", "%#{params[:request]}%")
.pluck(:path, :administrateur_id)
.inject([]) {
|acc, value| acc.push({label: value.first, mine: value.second == current_administrateur.id})