diff options
| author | Guo Xiang Tan <tgx_world@hotmail.com> | 2015-10-02 16:26:16 +0800 |
|---|---|---|
| committer | Guo Xiang Tan <tgx_world@hotmail.com> | 2015-10-02 16:26:16 +0800 |
| commit | 7d0b1e4847d1812b067e03266ca97d7bcb29d706 (patch) | |
| tree | ae9729d69065fd68ca662a835d62c07e0e63cfc0 /activerecord/lib | |
| parent | 9db73a2591e43d1851411727d6594a72efa35663 (diff) | |
| download | rails-7d0b1e4847d1812b067e03266ca97d7bcb29d706.tar.gz rails-7d0b1e4847d1812b067e03266ca97d7bcb29d706.tar.bz2 rails-7d0b1e4847d1812b067e03266ca97d7bcb29d706.zip | |
Fix AC::Parameters not being sanitized for query methods.
Diffstat (limited to 'activerecord/lib')
| -rw-r--r-- | activerecord/lib/active_record/relation/query_methods.rb | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/activerecord/lib/active_record/relation/query_methods.rb b/activerecord/lib/active_record/relation/query_methods.rb index eb53a18f0f..ccb0ab18ae 100644 --- a/activerecord/lib/active_record/relation/query_methods.rb +++ b/activerecord/lib/active_record/relation/query_methods.rb @@ -558,11 +558,8 @@ module ActiveRecord end def where!(opts, *rest) # :nodoc: - if Hash === opts - opts = sanitize_forbidden_attributes(opts) - references!(PredicateBuilder.references(opts)) - end - + opts = sanitize_forbidden_attributes(opts) + references!(PredicateBuilder.references(opts)) if Hash === opts self.where_clause += where_clause_factory.build(opts, rest) self end @@ -619,6 +616,7 @@ module ActiveRecord end def having!(opts, *rest) # :nodoc: + opts = sanitize_forbidden_attributes(opts) references!(PredicateBuilder.references(opts)) if Hash === opts self.having_clause += having_clause_factory.build(opts, rest) |