Skip to content

Instantly share code, notes, and snippets.

View dmexs's full-sized avatar

Emeka Anyanwu dmexs

View GitHub Profile
@dmexs
dmexs / example_controller.rb
Last active April 9, 2018 00:43 — forked from TheKidCoder/example_controller.rb
Rails - Sanitize Ordering Params
class ClientsController
include OrderingHelpers
def index
# order_by sanitation should work fine here, with sanitation to created_by if invalid
@clients = Clients.order(sanitized_ordering).where(user_id: current_user.id)
# trying to order_by sales.date for example will fail here even if it's valid if the current controller is not ClientController
@clients = Clients.joins(:sales).order(sanitized_ordering.where(user_id: current_user.id)