mirror of
https://github.com/discourse/discourse.git
synced 2026-08-06 07:23:30 +08:00
6b4d70b0e0The anniversaries controller was interpolating user timezone values directly into SQL via string interpolation. As a best practice, values should be properly escaped at the point of SQL construction. Moved timezone handling into cakedays_by() with a new apply_timezone parameter and used ActiveRecord::Base.connection.quote() to properly escape the value. This follows the same pattern used in discourse-rewind. Internal ref - t/102422
24 lines
627 B
Ruby
Vendored
24 lines
627 B
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
module DiscourseCakeday
|
|
class AnniversariesController < CakedayController
|
|
before_action :ensure_cakeday_enabled
|
|
|
|
def index
|
|
users, total, more_params =
|
|
cakedays_by("created_at", at_least_one_year_old: true, apply_timezone: true)
|
|
|
|
render_json_dump(
|
|
anniversaries: serialize_data(users, CakedayUserSerializer),
|
|
total_rows_anniversaries: total,
|
|
load_more_anniversaries: anniversaries_path(more_params),
|
|
)
|
|
end
|
|
|
|
private
|
|
|
|
def ensure_cakeday_enabled
|
|
raise Discourse::NotFound if !SiteSetting.cakeday_enabled
|
|
end
|
|
end
|
|
end
|
