aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--activerecord/CHANGELOG2
-rwxr-xr-xactiverecord/lib/active_record/base.rb2
-rwxr-xr-xactiverecord/test/base_test.rb3
3 files changed, 6 insertions, 1 deletions
diff --git a/activerecord/CHANGELOG b/activerecord/CHANGELOG
index 623e06d335..824233d692 100644
--- a/activerecord/CHANGELOG
+++ b/activerecord/CHANGELOG
@@ -1,5 +1,7 @@
*SVN*
+* Added that update_all calls sanitize_sql on its updates argument, so stuff like MyRecord.update_all(['time = ?', Time.now]) works #519 [notahat]
+
* Fixed that the dynamic finders didn't treat nil as a "IS NULL" but rather "= NULL" case #515 [Demetrius]
* Added bind-named arrays for interpolating a group of ids or strings in conditions #528 [bitsweat]
diff --git a/activerecord/lib/active_record/base.rb b/activerecord/lib/active_record/base.rb
index 0309f03a5a..51ee251871 100755
--- a/activerecord/lib/active_record/base.rb
+++ b/activerecord/lib/active_record/base.rb
@@ -368,7 +368,7 @@ module ActiveRecord #:nodoc:
# A subset of the records can be selected by specifying +conditions+. Example:
# Billing.update_all "category = 'authorized', approved = 1", "author = 'David'"
def update_all(updates, conditions = nil)
- sql = "UPDATE #{table_name} SET #{updates} "
+ sql = "UPDATE #{table_name} SET #{sanitize_sql(updates)} "
add_conditions!(sql, conditions)
return connection.update(sql, "#{name} Update")
end
diff --git a/activerecord/test/base_test.rb b/activerecord/test/base_test.rb
index f6d7e31683..02690b7396 100755
--- a/activerecord/test/base_test.rb
+++ b/activerecord/test/base_test.rb
@@ -287,6 +287,9 @@ class BasicsTest < Test::Unit::TestCase
assert_equal 2, Topic.update_all("content = 'bulk updated!'")
assert_equal "bulk updated!", Topic.find(1).content
assert_equal "bulk updated!", Topic.find(2).content
+ assert_equal 2, Topic.update_all(['content = ?', 'bulk updated again!']);
+ assert_equal "bulk updated again!", Topic.find(1).content
+ assert_equal "bulk updated again!", Topic.find(2).content
end
def test_delete_all