filter_out_illegal_query_filter_values.patch - Redmine

Defect #8371 » filter_out_illegal_query_filter_values.patch

Etienne Massip, 2011-10-19 20:20

         available_filters[field][:type] if available_filters.has_key?(field)
       end
       def allowed_values_for(field)
         if available_filters.has_key?(field)
           values = available_filters[field][:values]
           return values.first.is_a?(Array) ? values.collect {|val| val[1]} : values if values.present? && values.any?
         end
       end
       def operator_for(field)
         has_filter?(field) ? filters[field][:operator] : nil
       end
-...
         sql = ''
         case operator
         when "="
           value &= allowed_values_for(field) if allowed_values_for(field).present?
           if value.any?
             case type_for(field)
             when :date, :date_past
-...
             sql = "1=0"
           end
         when "!"
           value &= allowed_values_for(field) if allowed_values_for(field).present?
           if value.any?
             sql = "(#{db_table}.#{db_field} IS NULL OR #{db_table}.#{db_field} NOT IN (" + value.collect{|val| "'#{connection.quote_string(val)}'"}.join(",") + "))"
           else

             '!~This is part of a subject' => { :op => '!~', :values => ['This is part of a subject'] }},
           'tracker_id' => {
             '3' => { :op => '=', :values => ['3'] },
             '=3' => { :op => '=', :values => ['3'] }},
             '=3' => { :op => '=', :values => ['3'] },
             '*' => { :op => '=', :values => ['*'] },
             '!*' => { :op => '!', :values => ['*'] }},
           'start_date' => {
             '2011-10-12' => { :op => '=', :values => ['2011-10-12'] },
             '=2011-10-12' => { :op => '=', :values => ['2011-10-12'] },

(3-3/3)