DEV: Correct use of `sanitize_sql_array` in `TopicQuery`.

This commit is contained in:
Guo Xiang Tan 2020-09-08 12:30:09 +08:00
parent d3ebaa41ce
commit a1d135f12a
No known key found for this signature in database
GPG Key ID: FBD110179AAC1F20
1 changed files with 4 additions and 8 deletions

View File

@ -145,7 +145,7 @@ class TopicQuery
# strip out users in groups you already belong to
target_users = target_users
.joins("LEFT JOIN group_users gu ON gu.user_id = topic_allowed_users.user_id AND gu.group_id IN (#{sanitize_sql_array(my_group_ids)})")
.joins("LEFT JOIN group_users gu ON gu.user_id = topic_allowed_users.user_id AND #{ActiveRecord::Base.sanitize_sql_array(['gu.group_id IN (?)', my_group_ids])}")
.where('gu.group_id IS NULL')
end
@ -985,7 +985,7 @@ class TopicQuery
messages.joins("
LEFT JOIN topic_allowed_users ta2
ON topics.id = ta2.topic_id
AND ta2.user_id IN (#{sanitize_sql_array(user_ids)})
AND #{ActiveRecord::Base.sanitize_sql_array(['ta2.user_id IN (?)', user_ids])}
")
end
@ -994,7 +994,7 @@ class TopicQuery
messages.joins("
LEFT JOIN topic_allowed_groups tg2
ON topics.id = tg2.topic_id
AND tg2.group_id IN (#{sanitize_sql_array(group_ids)})
AND #{ActiveRecord::Base.sanitize_sql_array(['tg2.group_id IN (?)', group_ids])}
")
end
@ -1017,7 +1017,7 @@ class TopicQuery
LEFT JOIN group_users gu
ON gu.user_id = #{@user.id.to_i}
AND gu.group_id = _tg.group_id
WHERE gu.group_id IN (#{sanitize_sql_array(group_ids)})
WHERE #{ActiveRecord::Base.sanitize_sql_array(['gu.group_id IN (?)', group_ids])}
) tg ON topics.id = tg.topic_id
")
.where("tg.topic_id IS NOT NULL")
@ -1090,10 +1090,6 @@ class TopicQuery
private
def sanitize_sql_array(input)
ActiveRecord::Base.public_send(:sanitize_sql_array, input.join(','))
end
def append_read_state(list, group)
group_id = group&.id
return list if group_id.nil?