We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
We are working on the new ransack security updates and wondered if it is possible to amend this piece of logic to look for ransackable_scopes before checking attribute_method?: https://github.com/activerecord-hackery/ransack/blob/main/lib/ransack/search.rb#L105-L115
ransackable_scopes
attribute_method?
The reason is we explicitly allow certain ransack filters through ransackable_scopes method. This is the main way we greenlight ransack queries to our models. The trouble is if these scopes collide with attribute scopes then we enounter the allowlist raised deprecation error here: https://github.com/activerecord-hackery/ransack/blob/main/lib/ransack/adapters/active_record/base.rb#L112-L132
attribute
allowlist
Is it possible to check for explicitly allowed ransackable_scopes before checking for interpolated attribute ransack searches?
Suggested changes: ransack/lib/ransack/search.rb
ransack/lib/ransack/search.rb
def method_missing(method_id, *args) method_name = method_id.to_s getter_name = method_name.sub(/=$/, ''.freeze) if @context.ransackable_scope?(getter_name, @context.object) if method_name =~ /=$/ add_scope getter_name, args else @scope_args[method_name] end elsif base.attribute_method?(getter_name) base.send(method_id, *args) else super end end
The text was updated successfully, but these errors were encountered:
Issue activerecord-hackery#1472 suggested fix
92e330a
2045aac
No branches or pull requests
We are working on the new ransack security updates and wondered if it is possible to amend this piece of logic to look for
ransackable_scopes
before checkingattribute_method?
:https://github.com/activerecord-hackery/ransack/blob/main/lib/ransack/search.rb#L105-L115
The reason is we explicitly allow certain ransack filters through
ransackable_scopes
method. This is the main way we greenlight ransack queries to our models. The trouble is if these scopes collide withattribute
scopes then we enounter theallowlist
raised deprecation error here: https://github.com/activerecord-hackery/ransack/blob/main/lib/ransack/adapters/active_record/base.rb#L112-L132Is it possible to check for explicitly allowed
ransackable_scopes
before checking for interpolatedattribute
ransack searches?Suggested changes:
ransack/lib/ransack/search.rb
The text was updated successfully, but these errors were encountered: