sorted 0.4.2 → 0.4.3

data/README.rdoc

@@ -9,7 +9,7 @@ sort string to let you sort large datasets over many pages (using
 
 === Gemfile
 
-  gem 'sorted', '~> 0.4.2'
+  gem 'sorted', '~> 0.4.3'
 
 === View
 
@@ -17,6 +17,9 @@ Generate a sorted link with the email attribute:
 
   link_to_sorted "Email", :email
 
+Works the same as the +link_to+ method except a second argument for the
+sort attribute is needed.
+
 === Model
 
 Using the +sorted+ method with the optional default order argument:

data/lib/sorted/railtie.rb

@@ -2,17 +2,14 @@ require 'sorted'
 
 module Sorted
   class Railtie < Rails::Railtie
-    if defined? ::ActiveRecord
-      initializer "sorted.active_record" do |app|
+    initializer "sorted.configure" do |app|
+      ActiveSupport.on_load :active_record do
         require 'sorted/orms/active_record'
-        ::ActiveRecord::Base.send(:include, Sorted::Orms::ActiveRecord)
+        include Sorted::Orms::ActiveRecord
       end
-    end
-    
-    if defined? ::ActionView
-      initializer "sorted.action_view" do |app|
+      ActiveSupport.on_load :action_view do
         require 'sorted/view_helpers/action_view'
-        ::ActionView::Base.send(:include, Sorted::ViewHelpers::ActionView)
+        include Sorted::ViewHelpers::ActionView
       end
     end
   end

data/lib/sorted/toggler.rb

@@ -4,7 +4,7 @@ module Sorted
   #
   # Example:
   #   sorts  = [['name', 'asc'], ['phone', 'desc']]
-  #   oredrs = [['name', 'asc']]
+  #   orders = [['name', 'asc']]
   #   Sorted::Toggler.new(sorts, orders).to_a #-> [['name', 'desc'], ['phone', 'desc']]
   class Toggler
     def initialize(sorts, orders)

data/lib/sorted/version.rb

@@ -1,3 +1,3 @@
 module Sorted
-  VERSION = "0.4.2"
+  VERSION = "0.4.3"
 end

data/lib/sorted/view_helpers/action_view.rb

@@ -7,7 +7,7 @@ module Sorted
       class SortedViewHelper
         attr_reader :params
 
-        def initialize(order, params)
+        def initialize(order, params = {})
           sort = params.delete :sort
           @params = params
           @parser = ::Sorted::Parser.new(sort, order).toggle
@@ -23,10 +23,38 @@ module Sorted
         end
       end
 
-      def link_to_sorted(name, order, options = {})
+      # Creates a link tag of the given +name+ and +attribute+ creating
+      # a url using a set of +options+.
+      #
+      # ==== Examples
+      #
+      # Basic usage
+      #
+      #   link_to_sorted "Email", :email
+      #   # => <a href="/profiles?sort=email_asc" class="desc">Email</a>
+      #
+      # Or use a block
+      #
+      #   link_to_sorted :email do
+      #     <strong>Sort by email</strong> -- <span></span>
+      #   end
+      #   # => <a href="/profiles?sort=email_asc" class="desc"><strong>Sort by email</strong> -- <span></span></a>
+      #
+      def link_to_sorted(*args, &block)
+        if block_given?
+          order        = args[0]
+          options      = args[1] || {}
+          html_options = args[2] || {}
+        else
+          block        = proc { args[0].to_s }
+          order        = args[1]
+          options      = args[2] || {}
+          html_options = args[3] || {}
+        end
+
         sorter          = SortedViewHelper.new(order, ((request.get? && !params.nil?) ? params.dup : {}))
         options[:class] = [options[:class], sorter.css].join(' ').strip
-        link_to(name.to_s, sorter.params, options)
+        link_to(sorter.params, options, html_options, &block)
       end
     end
   end

data/spec/sorted/parser_spec.rb

@@ -87,4 +87,13 @@ describe Sorted::Parser, "return types" do
     sorter = Sorted::Parser.new(sort, order)
     sorter.to_s.should eq result
   end
+
+  it "sql injection using order by clause should not work" do
+    sort   = "(case+when+((ASCII(SUBSTR((select+table_name+from+all_tables+where+rownum%3d1),1))>%3D128))+then+id+else+something+end)"
+    order  = "email ASC, phone ASC, name DESC"
+    result = "email ASC, phone ASC, name DESC"
+
+    sorter = Sorted::Parser.new(sort, order)
+    sorter.to_sql.should eq result
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sorted
 version: !ruby/object:Gem::Version
-  version: 0.4.2
+  version: 0.4.3
   prerelease: 
 platform: ruby
 authors:
@@ -9,11 +9,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-03-21 00:00:00.000000000 Z
+date: 2012-06-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
-  requirement: &70138066080360 !ruby/object:Gem::Requirement
+  requirement: &70131329800380 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -21,10 +21,10 @@ dependencies:
         version: 1.0.0
   type: :development
   prerelease: false
-  version_requirements: *70138066080360
+  version_requirements: *70131329800380
 - !ruby/object:Gem::Dependency
   name: rails
-  requirement: &70138066078040 !ruby/object:Gem::Requirement
+  requirement: &70131329799320 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -32,10 +32,10 @@ dependencies:
         version: 3.1.2
   type: :development
   prerelease: false
-  version_requirements: *70138066078040
+  version_requirements: *70131329799320
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &70138066088680 !ruby/object:Gem::Requirement
+  requirement: &70131329817920 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -43,10 +43,10 @@ dependencies:
         version: 2.0.0
   type: :development
   prerelease: false
-  version_requirements: *70138066088680
+  version_requirements: *70131329817920
 - !ruby/object:Gem::Dependency
   name: sqlite3
-  requirement: &70138066087340 !ruby/object:Gem::Requirement
+  requirement: &70131329816300 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -54,7 +54,7 @@ dependencies:
         version: 1.3.5
   type: :development
   prerelease: false
-  version_requirements: *70138066087340
+  version_requirements: *70131329816300
 description: lets you sort large data sets using view helpers and a scope
 email:
 - rufuspost@gmail.com
@@ -95,7 +95,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 3265334023154358764
+      hash: -4246959904636690833
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements: