-
-
Notifications
You must be signed in to change notification settings - Fork 807
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Introduce ransack! so that invalid filters raise an exception #535
Comments
Hi @linkyndy, there is a configuration option |
Indeed, that's what I was referring to. While it's already there, I believe having a |
Feel free to make a PR 😃 |
Hi, Big fan of ransack! We've been using it at my company for a while now. One thing that we bumped into recently is that, by default, if you pass in a malformed parameter to ransack, it will ignore it, and by default return the whole collection. That's proved to be an unsafe way to operate for us, since it opened up clients who use our APIs to the possibility that they'll have a badly named search term, and instead of scoping the data to one person, they'll get a bunch of people's data. We did some digging, and discovered `ignore_unknown_conditions`, and will use that in all our apps. I wanted to see if you all would be open to changing the default behavior, since it seems like having `ignore_unknown_conditions => false` is a safer default than the current one. Seems like other people bumped into this at times unexpected behavior in the past. activerecord-hackery#852 activerecord-hackery#535 Either way, thank you maintainers for your continued work on this gem. Cheers!
It would be very useful to provide a method,
ransack!
, that will raise an exception if, say, a filter is not valid. Here's an example:If you do:
and
name
is a valid field ofClient
, the above would work. But if you do:an error would be more appropriate to be raisen instead of returning all addresses (
SELECT "addresses".* FROM "addresses"
).I find
ransack!
to be very useful; what do you think?The text was updated successfully, but these errors were encountered: