diff options
author | Sean McGivern <sean@mcgivern.me.uk> | 2018-04-18 13:26:44 +0300 |
---|---|---|
committer | Sean McGivern <sean@mcgivern.me.uk> | 2018-04-18 13:26:44 +0300 |
commit | 320ae8ff4a0f7da4056967d6ab1a48e071d4b31d (patch) | |
tree | 59523ba9b7e38fa97c7c7efd623c9d30f6a20d76 /app/helpers | |
parent | f150f262a9dee0ed329adf3fd30ea8a47a5e3c6b (diff) | |
parent | 2ee53feea8903b0c40c93b2b14aebd6991c46754 (diff) |
Merge branch 'blackst0ne-rails5-add-safe-params-helper' into 'master'
[Rails5] Add `safe_params` helper
See merge request gitlab-org/gitlab-ce!18241
Diffstat (limited to 'app/helpers')
-rw-r--r-- | app/helpers/blob_helper.rb | 2 | ||||
-rw-r--r-- | app/helpers/diff_helper.rb | 2 | ||||
-rw-r--r-- | app/helpers/safe_params_helper.rb | 11 |
3 files changed, 13 insertions, 2 deletions
diff --git a/app/helpers/blob_helper.rb b/app/helpers/blob_helper.rb index 866b8773db6..fef29789832 100644 --- a/app/helpers/blob_helper.rb +++ b/app/helpers/blob_helper.rb @@ -259,7 +259,7 @@ module BlobHelper options = [] if error == :collapsed - options << link_to('load it anyway', url_for(params.merge(viewer: viewer.type, expanded: true, format: nil))) + options << link_to('load it anyway', url_for(safe_params.merge(viewer: viewer.type, expanded: true, format: nil))) end # If the error is `:server_side_but_stored_externally`, the simple viewer will show the same error, diff --git a/app/helpers/diff_helper.rb b/app/helpers/diff_helper.rb index b5ca39711bc..1bb82fd8150 100644 --- a/app/helpers/diff_helper.rb +++ b/app/helpers/diff_helper.rb @@ -180,7 +180,7 @@ module DiffHelper private def diff_btn(title, name, selected) - params_copy = params.dup + params_copy = safe_params.dup params_copy[:view] = name # Always use HTML to handle case where JSON diff rendered this button diff --git a/app/helpers/safe_params_helper.rb b/app/helpers/safe_params_helper.rb new file mode 100644 index 00000000000..b568e8810cc --- /dev/null +++ b/app/helpers/safe_params_helper.rb @@ -0,0 +1,11 @@ +module SafeParamsHelper + # Rails 5.0 requires to permit `params` if they're used in url helpers. + # Use this helper when generating links with `params.merge(...)` + def safe_params + if params.respond_to?(:permit!) + params.except(:host, :port, :protocol).permit! + else + params + end + end +end |