mirror of
https://github.com/discourse/discourse.git
synced 2026-08-07 13:19:19 +08:00
6b4d70b0e0The anniversaries controller was interpolating user timezone values directly into SQL via string interpolation. As a best practice, values should be properly escaped at the point of SQL construction. Moved timezone handling into cakedays_by() with a new apply_timezone parameter and used ActiveRecord::Base.connection.quote() to properly escape the value. This follows the same pattern used in discourse-rewind. Internal ref - t/102422 |
||
|---|---|---|
| .. | ||
| controllers/discourse_cakeday | ||
| jobs/onceoff | ||
| serializers/discourse_cakeday | ||
