Skip to content

Conversation

@montulli
Copy link

@montulli montulli commented Aug 8, 2019

new 'sql_query' function that will return a raw SQL query.

  • Uses Rails 'sanitize_sql_for_conditions' to prevent SQL injection.
  • Adds an 'id_whitelist' to limit searches to just the id fields that are approved. This is similar to hard params

@sergey-koba-mobidev
Copy link

Looks promising, @SixiS what do you think?

@SixiS
Copy link
Owner

SixiS commented Jun 4, 2020

Thanks for all the work @montulli - really great idea.
Nice to see people still using this gem!

@sergey-koba-mobidev - I don't really like appending the sql-specific code to all the operator classes.
I have an idea to make the gem more extendible by making it so it can have different sets of evaluators / operators.

It's a bit of work tho, will see if I can get to it in the next few weeks.

@montulli
Copy link
Author

Howdy! Any more thoughts or progress on this functionality?

@SixiS
Copy link
Owner

SixiS commented Sep 11, 2021

@montulli - woah, thanks so much for pinging on it after so long!
Working on it now - will have a branch for the new stuff in the next week (for real).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants