Commit 96d66bcd

mo <mo.khan@gmail.com>
2017-09-23 15:26:21
fix params injection issue.
1 parent afc8702
Changed files (2)
app
views
db
app/views/cakes/index.html.erb
@@ -18,12 +18,12 @@
 <div class="row">
   <div class="col">
     <nav class="nav nav-pills nav-fill">
-      <%= link_to "All", url_for(params.merge(category: nil)), class: "nav-item nav-link #{"active" if params["category"].blank?}" %>
+      <%= link_to "All", cakes_path(sort: params[:sort]), class: "nav-item nav-link #{"active" if params["category"].blank?}" %>
       <% @categories.each do |category| %>
-        <%= link_to category.name.pluralize, url_for(params.merge(category: category.slug)), class: "nav-item nav-link #{"active" if params["category"] == category.slug}" %>
+        <%= link_to category.name.pluralize, cakes_path(category: category.slug, sort: params[:sort]), class: "nav-item nav-link #{"active" if params["category"] == category.slug}" %>
       <% end %>
-      <%= link_to "Newest", url_for(params.merge(sort: "newest")), class: "nav-item nav-link #{"active" if "newest" == params["sort"]}" %>
-      <%= link_to "Oldest", url_for(params.merge(sort: "oldest")), class: "nav-item nav-link #{"active" if "oldest" == params["sort"]}" %>
+      <%= link_to "Newest", cakes_path(category: params[:category], sort: "newest"), class: "nav-item nav-link #{"active" if "newest" == params["sort"]}" %>
+      <%= link_to "Oldest", cakes_path(category: params[:category], sort: "oldest"), class: "nav-item nav-link #{"active" if "oldest" == params["sort"]}" %>
     </nav>
   </div>
 </div>
db/schema.rb
@@ -17,11 +17,11 @@ ActiveRecord::Schema.define(version: 20170923150621) do
   enable_extension "uuid-ossp"
 
   create_table "activities", force: :cascade do |t|
-    t.integer  "subject_id",   null: false
-    t.string   "subject_type", null: false
-    t.integer  "user_id",      null: false
-    t.datetime "created_at",   null: false
-    t.datetime "updated_at",   null: false
+    t.integer  "subject_id",               null: false
+    t.string   "subject_type", limit: 255, null: false
+    t.integer  "user_id",                  null: false
+    t.datetime "created_at",               null: false
+    t.datetime "updated_at",               null: false
     t.index ["subject_id"], name: "index_activities_on_subject_id", using: :btree
     t.index ["subject_type"], name: "index_activities_on_subject_type", using: :btree
     t.index ["user_id"], name: "index_activities_on_user_id", using: :btree
@@ -29,26 +29,26 @@ ActiveRecord::Schema.define(version: 20170923150621) do
 
   create_table "avatars", force: :cascade do |t|
     t.integer  "user_id"
-    t.datetime "created_at"
-    t.datetime "updated_at"
-    t.string   "avatar"
+    t.datetime "created_at",                    null: false
+    t.datetime "updated_at",                    null: false
+    t.string   "avatar",            limit: 255
     t.boolean  "avatar_processing"
-    t.string   "avatar_tmp"
+    t.string   "avatar_tmp",        limit: 255
     t.index ["user_id"], name: "index_avatars_on_user_id", using: :btree
   end
 
   create_table "categories", force: :cascade do |t|
-    t.string   "name"
+    t.string   "name",       limit: 255
     t.datetime "created_at"
     t.datetime "updated_at"
-    t.string   "slug"
+    t.string   "slug",       limit: 255
     t.index ["slug"], name: "index_categories_on_slug", using: :btree
   end
 
   create_table "comments", force: :cascade do |t|
     t.integer  "user_id"
     t.integer  "creation_id"
-    t.string   "text"
+    t.string   "text",        limit: 255
     t.integer  "disqus_id"
     t.datetime "created_at"
     t.datetime "updated_at"
@@ -57,15 +57,15 @@ ActiveRecord::Schema.define(version: 20170923150621) do
   end
 
   create_table "creations", force: :cascade do |t|
-    t.string   "name"
+    t.string   "name",            limit: 255
     t.text     "story"
     t.datetime "created_at"
     t.datetime "updated_at"
     t.integer  "user_id"
-    t.string   "image"
-    t.string   "watermark"
-    t.integer  "photos_count",    default: 0
-    t.integer  "favorites_count", default: 0
+    t.string   "image",           limit: 255
+    t.string   "watermark",       limit: 255
+    t.integer  "photos_count",                default: 0
+    t.integer  "favorites_count",             default: 0
     t.integer  "category_id"
     t.index ["category_id"], name: "index_creations_on_category_id", using: :btree
     t.index ["created_at"], name: "index_creations_on_created_at", using: :btree
@@ -73,21 +73,21 @@ ActiveRecord::Schema.define(version: 20170923150621) do
   end
 
   create_table "delayed_jobs", force: :cascade do |t|
-    t.integer  "priority",   default: 0
-    t.integer  "attempts",   default: 0
+    t.integer  "priority",               default: 0
+    t.integer  "attempts",               default: 0
     t.text     "handler"
     t.text     "last_error"
     t.datetime "run_at"
     t.datetime "locked_at"
     t.datetime "failed_at"
-    t.string   "locked_by"
-    t.string   "queue"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.string   "locked_by",  limit: 255
+    t.string   "queue",      limit: 255
+    t.datetime "created_at",                         null: false
+    t.datetime "updated_at",                         null: false
     t.index ["priority", "run_at"], name: "delayed_jobs_priority", using: :btree
   end
 
-  create_table "favorites", force: :cascade do |t|
+  create_table "favorites", id: :integer, default: -> { "nextval('likes_id_seq'::regclass)" }, force: :cascade do |t|
     t.integer  "user_id"
     t.integer  "creation_id"
     t.datetime "created_at"
@@ -97,18 +97,18 @@ ActiveRecord::Schema.define(version: 20170923150621) do
   end
 
   create_table "interests", force: :cascade do |t|
-    t.string   "name"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.string   "name",       limit: 255
+    t.datetime "created_at",             null: false
+    t.datetime "updated_at",             null: false
   end
 
   create_table "locations", id: :uuid, default: -> { "uuid_generate_v4()" }, force: :cascade do |t|
     t.uuid     "locatable_id"
-    t.string   "locatable_type"
-    t.string   "latitude"
-    t.string   "longitude"
-    t.string   "city"
-    t.string   "country"
+    t.string   "locatable_type", limit: 255
+    t.string   "latitude",       limit: 255
+    t.string   "longitude",      limit: 255
+    t.string   "city",           limit: 255
+    t.string   "country",        limit: 255
     t.datetime "created_at"
     t.datetime "updated_at"
     t.index ["locatable_id", "locatable_type"], name: "index_locations_on_locatable_id_and_locatable_type", using: :btree
@@ -116,18 +116,18 @@ ActiveRecord::Schema.define(version: 20170923150621) do
 
   create_table "photos", force: :cascade do |t|
     t.integer  "imageable_id"
-    t.string   "image"
+    t.string   "image",             limit: 255
     t.datetime "created_at"
     t.datetime "updated_at"
-    t.string   "image_tmp"
+    t.string   "image_tmp",         limit: 255
     t.boolean  "image_processing"
-    t.string   "content_type"
-    t.string   "original_filename"
+    t.string   "content_type",      limit: 255
+    t.string   "original_filename", limit: 255
     t.float    "latitude"
     t.float    "longitude"
-    t.string   "sha256"
-    t.string   "watermark"
-    t.string   "imageable_type"
+    t.string   "sha256",            limit: 255
+    t.string   "watermark",         limit: 255
+    t.string   "imageable_type",    limit: 255
     t.index ["imageable_id", "imageable_type"], name: "index_photos_on_imageable_id_and_imageable_type", using: :btree
     t.index ["imageable_id"], name: "index_photos_on_imageable_id", using: :btree
   end
@@ -135,9 +135,9 @@ ActiveRecord::Schema.define(version: 20170923150621) do
   create_table "taggings", force: :cascade do |t|
     t.integer  "tag_id"
     t.integer  "taggable_id"
-    t.string   "taggable_type"
+    t.string   "taggable_type", limit: 255
     t.integer  "tagger_id"
-    t.string   "tagger_type"
+    t.string   "tagger_type",   limit: 255
     t.string   "context",       limit: 128
     t.datetime "created_at"
     t.index ["context"], name: "index_taggings_on_context", using: :btree
@@ -153,8 +153,8 @@ ActiveRecord::Schema.define(version: 20170923150621) do
   end
 
   create_table "tags", force: :cascade do |t|
-    t.string  "name"
-    t.integer "taggings_count", default: 0
+    t.string  "name",           limit: 255
+    t.integer "taggings_count",             default: 0
     t.index ["name"], name: "index_tags_on_name", unique: true, using: :btree
   end
 
@@ -169,15 +169,15 @@ ActiveRecord::Schema.define(version: 20170923150621) do
   end
 
   create_table "tutorials", force: :cascade do |t|
-    t.string   "heading"
+    t.string   "heading",     limit: 255
     t.text     "description"
-    t.string   "url"
+    t.string   "url",         limit: 255
     t.integer  "user_id"
-    t.datetime "created_at"
-    t.datetime "updated_at"
-    t.string   "image_url"
-    t.string   "author"
-    t.string   "author_url"
+    t.datetime "created_at",              null: false
+    t.datetime "updated_at",              null: false
+    t.string   "image_url",   limit: 255
+    t.string   "author",      limit: 255
+    t.string   "author_url",  limit: 255
     t.index ["user_id"], name: "index_tutorials_on_user_id", using: :btree
   end
 
@@ -185,8 +185,8 @@ ActiveRecord::Schema.define(version: 20170923150621) do
     t.integer  "user_id"
     t.datetime "created_at"
     t.datetime "updated_at"
-    t.string   "key"
-    t.string   "ip"
+    t.string   "key",         limit: 255
+    t.string   "ip",          limit: 255
     t.text     "user_agent"
     t.datetime "accessed_at"
     t.datetime "revoked_at"
@@ -197,22 +197,22 @@ ActiveRecord::Schema.define(version: 20170923150621) do
   end
 
   create_table "users", force: :cascade do |t|
-    t.string   "email",                  default: "", null: false
-    t.string   "password_digest",        default: "", null: false
-    t.string   "reset_password_token"
+    t.string   "email",                  limit: 255, default: "", null: false
+    t.string   "password_digest",        limit: 128, default: "", null: false
+    t.string   "reset_password_token",   limit: 255
     t.datetime "reset_password_sent_at"
     t.datetime "created_at"
     t.datetime "updated_at"
-    t.string   "name"
-    t.string   "website"
-    t.string   "twitter"
-    t.string   "facebook"
-    t.string   "city"
-    t.string   "authentication_token"
-    t.string   "full_address"
-    t.integer  "creations_count",        default: 0
+    t.string   "name",                   limit: 255
+    t.string   "website",                limit: 255
+    t.string   "twitter",                limit: 255
+    t.string   "facebook",               limit: 255
+    t.string   "city",                   limit: 255
+    t.string   "authentication_token",   limit: 255
+    t.string   "full_address",           limit: 255
+    t.integer  "creations_count",                    default: 0
     t.boolean  "admin"
-    t.integer  "photos_count",           default: 0
+    t.integer  "photos_count",                       default: 0
     t.index ["authentication_token"], name: "index_users_on_authentication_token", unique: true, using: :btree
     t.index ["created_at"], name: "index_users_on_created_at", using: :btree
     t.index ["email"], name: "index_users_on_email", unique: true, using: :btree