ricky/redmine_qbo
1
1
Fork 0
mirror of https://github.com/rickbarrette/redmine_qbo.git synced 2026-04-02 08:21:57 -04:00
Code Issues Actions Packages Projects Releases Wiki Activity

Sanitize search, no little bobby tables

Browse Source
This commit is contained in:
Ricky Barrette
2026-02-21 08:23:58 -05:00
parent 659a1fbcf0
commit 9b656534ae
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
app/models/customer.rb
View File

@@ -169,6 +169,7 @@ class Customer < ActiveRecord::Base
# Searchs the database for a customer by name or phone number with out special chars # Searchs the database for a customer by name or phone number with out special chars
def self.search(search) def self.search(search)
search = sanitize_sql_like(search)
customers = where("name LIKE ? OR phone_number LIKE ? OR mobile_phone_number LIKE ?", "%#{search}%", "%#{search}%", "%#{search}%") customers = where("name LIKE ? OR phone_number LIKE ? OR mobile_phone_number LIKE ?", "%#{search}%", "%#{search}%", "%#{search}%")
return customers.order(:name) return customers.order(:name)
end end