apicasso 0.7.0 → 0.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '086a86d3630f5d6eacfc9c29f06cc4fc50e82396a87fe5503fbe68d52b71bf94'
-  data.tar.gz: 226636f006ebcb055aef0a6ec01757f13e3270f729d8e05c18f208e7d4c4964b
+  metadata.gz: 810b5957d80a9681e838d2e7efcc9d02ff0bc4c91ed0ad6156f58517aac54139
+  data.tar.gz: 34a5aeb6ede33634cf03155ab61ed849e39d12e09be73cc3594b6226f554d144
 SHA512:
-  metadata.gz: 33338becd3fd0dc6ee19c65d07f866943d7e5358504a7732d572f694f85e80ac511424dcc10f75edaefd7d1ac88e9062c3ee81155e816f2dc79665e2c90820b6
-  data.tar.gz: e1c2d870b61a28bc9b6ced33a19d4edfc0c7068f618a44a45dc3e7523db9ce4870840f27042a3998336d50e61ab1df12a21d276b971ef43003b1d5e716405682
+  metadata.gz: a94dee1047d8ddd8d5af90d6232de8d56e6724aeb2fc156fc7e4479e99251a9fbf54618812f5147cb832ee40b3a006add80b47ceeb2937f9c82cce0d167504b3
+  data.tar.gz: 83ecc747872fcf84f21835ad586b8140a6b7898bda2ae988792d1382c77b7a49fc255f0a765e7b2712ed55da1428d50ed4701f637021b9674de821ce1fa3358b

data/app/controllers/apicasso/crud_controller.rb

@@ -135,8 +135,8 @@ module Apicasso
         @records.group(params[:group][:by].split(','))
                 .send(:calculate,
                       params[:group][:calculate],
-                      params[:group][:fields])
-     else
+                      params[:group][:field])
+      else
         collection_response
       end
     end

data/app/controllers/concerns/sql_security.rb

@@ -31,8 +31,8 @@ module SqlSecurity
   ].freeze
 
   # Check if request is a SQL injection
-  def sql_injection(klass)
-    apicasso_parameters.each do |name, value|
+  def sql_injection(klass, hash = nil)
+    apicasso_parameters(hash).each do |name, value|
       next unless Array.wrap(klass).any? do |klass|
         !safe_parameter?(klass, name, value)
       end
@@ -47,8 +47,13 @@ module SqlSecurity
   def safe_parameter?(klass, name, value)
     if name.to_sym == :group
       group_sql_safe?(klass, value)
-    elsif params[:batch].present?
-      parameters_sql_safe?(klass.singularize.constantize, value)
+    elsif name.to_sym == :batch
+      value.each do |name, val|
+        parameters_sql_safe?(klass.name.singularize.constantize, name)
+        Array.wrap(value).each do |inner_val|
+          sql_injection(klass, inner_val)
+        end
+      end
     else
       parameters_sql_safe?(klass, value)
     end
@@ -120,7 +125,7 @@ module SqlSecurity
 
   # Parameters used on the APIcasso that should be checked against
   # security measures
-  def apicasso_parameters
-    params.to_unsafe_h.slice(:group, :resource, :nested, :sort, :include, :crud)
+  def apicasso_parameters(hash = nil)
+    (hash || params.to_unsafe_h).slice(:group, :resource, :nested, :sort, :include, :batch)
   end
 end

data/lib/apicasso/version.rb

@@ -3,5 +3,5 @@
 # A Module to rule them all...
 module Apicasso
   # Current gem version
-  VERSION = '0.7.0'.freeze
+  VERSION = '0.7.1'.freeze
 end

data/spec/requests/batch_spec.rb

@@ -13,6 +13,7 @@ RSpec.describe 'Batch requests', type: :request do
         @used_model = create(:used_model)
         @another_used_model = create(:used_model)
         while @another_used_model.send(@attribute) == @used_model.send(@attribute)
+          @attribute = UsedModel.column_names.sample
           @another_used_model = create(:used_model)
         end
         post '/api/v1/ql/', params: { used_models: { "#{@attribute}_eq": @used_model.send(@attribute) } }.to_json, headers: access_token

data/spec/requests/plurarized/requests_with_plurarize_spec.rb

@@ -100,7 +100,7 @@ RSpec.describe 'Used Model requests', type: :request do
       end
 
       it 'returns all records sorted queried' do
-        used_model_sorted = UsedModel.order(:brand, :model).map(&:id)
+        used_model_sorted = UsedModel.unscope(:order).order(brand: :asc, model: :asc).map(&:id)
         entries = JSON.parse(response.body)['entries'].map { |model| model['id'] }
         expect(entries).to eq(used_model_sorted)
       end

data/spec/requests/singularized/requests_spec.rb

@@ -100,7 +100,7 @@ RSpec.describe 'Used Model requests', type: :request do
       end
 
       it 'returns all records sorted queried' do
-        used_model_sorted = UsedModel.order(:brand, :model).map(&:id)
+        used_model_sorted = UsedModel.unscope(:order).order(brand: :asc, model: :asc).map(&:id)
         entries = JSON.parse(response.body)['entries'].map { |model| model['id'] }
         expect(entries).to eq(used_model_sorted)
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: apicasso
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.7.1
 platform: ruby
 authors:
 - Fernando Bellincanta
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-04-15 00:00:00.000000000 Z
+date: 2019-04-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -168,16 +168,16 @@ dependencies:
   name: rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">"
       - !ruby/object:Gem::Version
-        version: '5.1'
+        version: '5'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">"
       - !ruby/object:Gem::Version
-        version: '5.1'
+        version: '5'
 - !ruby/object:Gem::Dependency
   name: ransack
   requirement: !ruby/object:Gem::Requirement