Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
张重言
rails
提交
9340f898
R
rails
项目概览
张重言
/
rails
通知
1
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
R
rails
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
9340f898
编写于
5月 30, 2012
作者:
A
Aaron Patterson
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
predicate builder should not recurse for determining where columns.
Thanks to Ben Murphy for reporting this CVE-2012-2661
上级
344ea048
变更
3
隐藏空白更改
内联
并排
Showing
3 changed file
with
37 addition
and
3 deletion
+37
-3
activerecord/lib/active_record/associations/association_scope.rb
...ecord/lib/active_record/associations/association_scope.rb
+17
-2
activerecord/lib/active_record/relation/predicate_builder.rb
activerecord/lib/active_record/relation/predicate_builder.rb
+1
-1
activerecord/test/cases/relation/where_test.rb
activerecord/test/cases/relation/where_test.rb
+19
-0
未找到文件。
activerecord/lib/active_record/associations/association_scope.rb
浏览文件 @
9340f898
...
...
@@ -96,7 +96,7 @@ def add_constraints(scope)
conditions
.
each
do
|
condition
|
if
options
[
:through
]
&&
condition
.
is_a?
(
Hash
)
condition
=
{
table
.
name
=>
condition
}
condition
=
disambiguate_condition
(
table
,
condition
)
end
scope
=
scope
.
where
(
interpolate
(
condition
))
...
...
@@ -113,7 +113,7 @@ def add_constraints(scope)
conditions
.
each
do
|
condition
|
condition
=
interpolate
(
condition
)
condition
=
{
(
table
.
table_alias
||
table
.
name
)
=>
condition
}
unless
i
==
0
condition
=
disambiguate_condition
(
table
,
condition
)
unless
i
==
0
scope
=
scope
.
where
(
condition
)
end
...
...
@@ -138,6 +138,21 @@ def table_name_for(reflection)
end
end
def
disambiguate_condition
(
table
,
condition
)
if
condition
.
is_a?
(
Hash
)
Hash
[
condition
.
map
do
|
k
,
v
|
if
v
.
is_a?
(
Hash
)
[
k
,
v
]
else
[
table
.
table_alias
||
table
.
name
,
{
k
=>
v
}]
end
end
]
else
condition
end
end
end
end
end
activerecord/lib/active_record/relation/predicate_builder.rb
浏览文件 @
9340f898
...
...
@@ -6,7 +6,7 @@ def self.build_from_hash(engine, attributes, default_table)
if
value
.
is_a?
(
Hash
)
table
=
Arel
::
Table
.
new
(
column
,
engine
)
build_from_hash
(
engine
,
value
,
table
)
value
.
map
{
|
k
,
v
|
build
(
table
[
k
.
to_sym
],
v
)
}
else
column
=
column
.
to_s
...
...
activerecord/test/cases/relation/where_test.rb
0 → 100644
浏览文件 @
9340f898
require
"cases/helper"
require
'models/post'
module
ActiveRecord
class
WhereTest
<
ActiveRecord
::
TestCase
fixtures
:posts
def
test_where_error
assert_raises
(
ActiveRecord
::
StatementInvalid
)
do
Post
.
where
(
:id
=>
{
'posts.author_id'
=>
10
}).
first
end
end
def
test_where_with_table_name
post
=
Post
.
first
assert_equal
post
,
Post
.
where
(
:posts
=>
{
'id'
=>
post
.
id
}).
first
end
end
end
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录