easy_filter 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 33a6ad9f7885ba310d7af29cfbcc4079bdfe873b
-  data.tar.gz: aebb6dbfa96193f59ace2196b4cc53d4574f0baf
+  metadata.gz: 586866917848c0737f4cee36ad8651f512b4f12e
+  data.tar.gz: a27d5d81b98bceb88ea7be9bc6467a3a0d8fe58d
 SHA512:
-  metadata.gz: c3185343808ee0ea0f6c2a717dad50b7e253f05ee959c6f3fe3441e7213d6c7c13830ceebcd8d5d572f7506353202d3470783a7e96b0a87f1d42122732a21c27
-  data.tar.gz: bb892f3bfbceaf2a07a727e4cb91bd19905425a0a4660c28872b4bbd5e661cf5213a3c4cba4be04b1e79ff362dbe247bcf2a1a0c8fd3f6e2abfe1214afa9fd26
+  metadata.gz: fd796bf841dc16766a28db674a4353955b107ed79ba8ba2a7fed6314b00f0a5a9ee6c5456fe1898828e369834aa01fbde755b5ec95301e98e7e0fb37ed986dd8
+  data.tar.gz: c24cf86bbf1440c56b0affd17a36d47033b1b47c384044bb5fc9d30ca9eebf4249dc83fc166f9e47eaf17c02b16bdf6e935803265a667df2d99458a1a84cca4e

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## V0.3.0
+* Correct XSS problem and add default config to view helper
+* correct typeo in gemspec
+* Define jquery-ui version numbers based on Hakiri warnings
+* Update README.md
+
 ## V0.2.0
 * Correct Rubocop ABC errors with refactoring
 * RSpec tests for field with more underscores

data/README.md

@@ -2,7 +2,7 @@
 
 By [Peter Kepes](https://github.com/kepes)
 
-[![Build Status](https://travis-ci.org/kepes/easy-filter.svg?branch=master)](https://travis-ci.org/kepes/easy-filter)
+[![Build Status](https://travis-ci.org/kepes/easy-filter.svg?branch=master)](https://travis-ci.org/kepes/easy-filter) [![Gem Version](https://badge.fury.io/rb/easy_filter.svg)](http://badge.fury.io/rb/easy_filter) [![Code Climate](https://codeclimate.com/github/kepes/easy-filter/badges/gpa.svg)](https://codeclimate.com/github/kepes/easy-filter)
 
 Filter and sort `ActiveRecord` model for Rails app with [Bootstrap](http://getbootstrap.com/) view helpers.
 
@@ -92,18 +92,18 @@ Default view helper templates generates [Bootstrap](http://getbootstrap.com/) co
     app/views/easy_filter/_form_field_close.html.erb
     app/views/easy_filter/_form_open.html.erb
 
-#### Advanced parameters
-
-View helpers provide paramters to define HTML input field names.
-
-    def easy_filter(model_class, filters, prefixes = { main: 'filter_', from: 'from_', to: 'to_', exact: 'exact_' })
-
-    def easy_sort(column, title = nil, sort = 'sort', direction = 'direction')
-
-All default templates will use specified prefixes for input fields. If you have to use different names just use this parameters to redefine it.
+#### Configuration
 
-If you change prefix parameters dont't forget to change it for model addition too!
+You can configure input field names used by EasyFilter in environments
 
+    Rails.application.configure do
+      config.easy_filter_defaults = {
+        prefixes: { main: 'filter_', from: 'from_', to: 'to_', exact: 'exact_' },
+        allowed_params: %w(sort direction),
+        sort_params: { field: 'sort', direction: 'direction' }
+      }
+    end
+    
 ## Contributing
 
 1. Fork it

data/app/views/easy_filter/_buttons.html.erb

@@ -1,2 +1,2 @@
 <%= button_tag(t(:filter), name: "#{filter_prefixes[:main]}button", value: :filter, class: 'btn btn-default') %>
-<%= link_to t(:clear_filter), request.parameters.select {|k,v| !k.to_s.starts_with?(filter_prefixes[:main])}, class: 'btn btn-default' %>
+<%= link_to t(:clear_filter), cleaned_params.select { |k,v| !k.to_s.starts_with?(filter_prefixes[:main])}, class: 'btn btn-default' %>

data/app/views/easy_filter/_sort_field.html.erb

@@ -1,2 +1,2 @@
 <% icon = "<span class=\"glyphicon glyphicon-chevron-#{direction == "asc" ? "up" : "down"}\"></span>" %>
-<%= link_to "#{title} #{column == params[sort_param_name] ? icon : ''}".html_safe, request.parameters.merge(sort_param_name => column, direction_param_name => direction) %>
+<%= link_to "#{title} #{column == cleaned_params[sort_param_name] ? icon : ''}".html_safe, cleaned_params.merge(sort_param_name => column, direction_param_name => direction) %>

data/easy_filter.gemspec

@@ -23,6 +23,6 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency 'rubocop'
   spec.add_development_dependency 'activerecord', '~> 3.2'
   spec.add_development_dependency 'sqlite3'
-  spec.add_runtime_dependency 'jquery-rails'
-  spec.add_runtime_dependency 'jquery-ui-rails'
+  spec.add_runtime_dependency 'jquery-rails', '~> 3.1.4'
+  spec.add_runtime_dependency 'jquery-ui-rails', '~> 5.0.5'
 end

data/lib/easy_filter/version.rb

@@ -1,4 +1,4 @@
 # EasyFilter version number
 module EasyFilter
-  VERSION = '0.2.0'
+  VERSION = '0.3.0'
 end

data/lib/easy_filter/view_helpers.rb

@@ -1,37 +1,58 @@
 module EasyFilter
   # View helpers for EasyFilter
   module ViewHelpers
-    def easy_sort(column, title = nil, sort = 'sort', direction = 'direction')
+    def easy_sort(column, title = nil)
+      config = easy_filter_defaults
+      cleaned_params = clean_params params, config
       title ||= column.titleize
-      dir = (column.to_s == params[sort] && params[direction] == 'asc') ? 'desc' : 'asc'
+      dir = sort_direction column, config
 
       render partial: 'easy_filter/sort_field',
-             locals: { column: column.to_s,
-                       title: title,
-                       sort_param_name: sort,
-                       direction: dir,
-                       direction_param_name: direction }
+             locals:
+             { column: column.to_s,
+               title: title,
+               sort_param_name: config[:sort_params][:field],
+               direction: dir,
+               direction_param_name: config[:sort_params][:direction],
+               cleaned_params: cleaned_params
+             }
     end
 
-    def easy_filter(model_class, filters, prefixes = { main: 'filter_', from: 'from_', to: 'to_', exact: 'exact_' })
-      form = render_easy 'form_open', prefixes, model_class
+    def easy_filter(model_class, filters)
+      config = easy_filter_defaults
+      cleaned_params = clean_params params, config
+      form = render_easy 'form_open', config, cleaned_params
 
       filters.each do |filter|
         f = determine_column filter, model_class
-        form += render_field f, prefixes
+        form += render_field f, config, cleaned_params
       end
 
-      form += render_easy 'buttons', prefixes
-      form += render_easy 'form_close', prefixes
+      form += render_easy 'buttons', config, cleaned_params
+      form += render_easy 'form_close', config, cleaned_params
     end
 
     private
 
-    def render_field(filter, prefixes)
-      form = render_easy 'form_field_open', prefixes
+    def easy_filter_defaults
+      rails_defaults = Rails.configuration.easy_filter_defaults if defined? Rails.configuration.easy_filter_defaults
+      rails_defaults ||= {}
+      {
+        prefixes: { main: 'filter_', from: 'from_', to: 'to_', exact: 'exact_' },
+        allowed_params: %w(sort direction),
+        sort_params: { field: 'sort', direction: 'direction' }
+      }.deep_merge rails_defaults
+    end
+
+    def sort_direction(column, config)
+      (column.to_s == params[config[:sort_params][:field]] && params[config[:sort_params][:direction]] == 'asc') ? 'desc' : 'asc'
+    end
+
+    def render_field(filter, config, cleaned_params)
+      form = render_easy 'form_field_open', config, cleaned_params
       view = column_view filter[:col_type]
-      form += render_easy view, prefixes, filter
-      form + render_easy('form_field_close', prefixes)
+      form += render_easy view, config, cleaned_params, filter
+      form + render_easy('form_field_close', config, cleaned_params)
     end
 
     def column_view(col_type)
@@ -78,10 +99,17 @@ module EasyFilter
       filter
     end
 
-    def render_easy(name, prefixes, filter = nil)
+    def render_easy(name, config, cleaned_params, filter = nil)
       render partial: "easy_filter/#{name}",
-             locals: { filter_prefixes: prefixes,
-                       filter: filter }
+             locals: {
+               filter_prefixes: config[:prefixes],
+               filter: filter,
+               cleaned_params: cleaned_params
+             }
+    end
+
+    def clean_params(params, config)
+      params.select { |k| k.to_s.starts_with?(config[:prefixes][:main]) || config[:allowed_params].include?(k) }
     end
 
     def boolean_array

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: easy_filter
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Peter Kepes
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-09-23 00:00:00.000000000 Z
+date: 2015-09-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -98,30 +98,30 @@ dependencies:
   name: jquery-rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 3.1.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 3.1.4
 - !ruby/object:Gem::Dependency
   name: jquery-ui-rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 5.0.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 5.0.5
 description: Filter and sort ActiveRecord model for Rails app with Bootstrap view
   helpers
 email: