mirror of
https://github.com/discourse/discourse.git
synced 2026-08-06 13:08:40 +08:00
6b4d70b0e0The anniversaries controller was interpolating user timezone values directly into SQL via string interpolation. As a best practice, values should be properly escaped at the point of SQL construction. Moved timezone handling into cakedays_by() with a new apply_timezone parameter and used ActiveRecord::Base.connection.quote() to properly escape the value. This follows the same pattern used in discourse-rewind. Internal ref - t/102422 |
||
|---|---|---|
| .. | ||
| integration | ||
| jobs | ||
| serializers | ||
| system | ||
