raggedstaff/openfoodnetwork
1
0
Fork 0
mirror of https://github.com/openfoodfoundation/openfoodnetwork synced 2026-01-24 20:36:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Restrict search params passed to ProductsRenderer

Browse Source
This commit is contained in:
Matt-Yorkley
2019-10-09 18:35:10 +01:00
parent 37e5e1923c
commit c730958fe4
1 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
app/controllers/api/order_cycles_controller.rb
View File

@@ -10,7 +10,7 @@ module Api
distributor,
order_cycle,
customer,
params.slice(:q, :page, :per_page)
search_params
).products_json
render json: products
@@ -40,6 +40,20 @@ module Api
private
def search_params
permitted_search_params = params.slice :q, :page, :per_page
if permitted_search_params.key? :q
permitted_search_params[:q].slice!(*permitted_ransack_params)
end
permitted_search_params
end
def permitted_ransack_params
[:name_or_meta_keywords_or_supplier_name_cont, :properites_in_any, :primary_taxon_id_in_any]
end
def distributor
Enterprise.find_by_id(params[:distributor])
end