gistfile1.txt

 SecurityError in Dashboard#index

Showing app/views/layouts/application.html.haml where line #58 raised:

tainted sql: SELECT DISTINCT rm.jurisdiction_id, p.priv_name
                                  FROM users u, role_memberships rm, privileges_roles pr, privileges p
                                  WHERE u.uid = 'utah'
                                  AND u.id = rm.user_id
                                  AND rm.role_id = pr.role_id
                                  AND pr.privilege_id = p.id

Extracted source (around line #58):

55:             = image_tag("logo.png", :border => 0)
56:         .right
57:           .areas
58:             - if User.current_user.is_entitled_to?(:create_event)
59:               = link_to 'NEW CMR', event_search_cmrs_path
60:               |
61: 

RAILS_ROOT: /home/placey/Development/trisano/webapp
Application Trace | Framework Trace | Full Trace

/home/placey/Development/trisano/webapp/vendor/plugins/safe_record/lib/safe_record.rb:24:in `execute'
/usr/lib/ruby/gems/1.8/gems/activerecord-2.3.2/lib/active_record/connection_adapters/postgresql_adapter.rb:985:in `select_raw'
/usr/lib/ruby/gems/1.8/gems/activerecord-2.3.2/lib/active_record/connection_adapters/postgresql_adapter.rb:972:in `select'
/usr/lib/ruby/gems/1.8/gems/activerecord-2.3.2/lib/active_record/connection_adapters/abstract/database_statements.rb:7:in `select_all_without_query_cache'
/usr/lib/ruby/gems/1.8/gems/activerecord-2.3.2/lib/active_record/connection_adapters/abstract/query_cache.rb:60:in `select_all'
/usr/lib/ruby/gems/1.8/gems/activerecord-2.3.2/lib/active_record/connection_adapters/abstract/query_cache.rb:81:in `cache_sql'
/usr/lib/ruby/gems/1.8/gems/activerecord-2.3.2/lib/active_record/connection_adapters/abstract/query_cache.rb:60:in `select_all'
/usr/lib/ruby/gems/1.8/gems/activerecord-2.3.2/lib/active_record/base.rb:661:in `find_by_sql'
/home/placey/Development/trisano/webapp/app/models/user.rb:55:in `get_privs'
/home/placey/Development/trisano/webapp/app/models/user.rb:48:in `privs'
/home/placey/Development/trisano/webapp/app/models/user.rb:85:in `is_entitled_to?'
/home/placey/Development/trisano/webapp/app/views/layouts/application.html.haml:58:in `_run_haml_app47views47layouts47application46html46haml'
/home/placey/Development/trisano/webapp/app/controllers/dashboard_controller.rb:27:in `index'