From 04450e10866fc56890426525062fd5cdf56c4300 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Fri, 17 Jul 2026 19:30:43 +0200 Subject: Allowlist aggregate order columns and template names Page.aggregate interpolated order_by into SQL unchecked while already allowlisting order_direction; the column is now normalized and checked against the sortable columns, falling back to pages.id. Its values arrive from editor-authored aggregate shortcodes, so this was editor-gated, but the asymmetry was wrong regardless. template_name and default_template_name now validate inclusion in Page.custom_templates -- names render as filesystem paths, so only names actually present in the template directory are acceptable. Validated only on change: legacy rows whose template file has since vanished stay saveable, and valid_template's render-time fallback to standard_template continues to cover them. Two tests that wrote fabricated template names through the front door now arrange their state correctly (update_column for the stale-name fallback test, a real template for the update-persists test). --- test/controllers/content_controller_test.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'test/controllers/content_controller_test.rb') diff --git a/test/controllers/content_controller_test.rb b/test/controllers/content_controller_test.rb index e8bc55f..2449a0c 100644 --- a/test/controllers/content_controller_test.rb +++ b/test/controllers/content_controller_test.rb @@ -73,8 +73,7 @@ class ContentControllerTest < ActionController::TestCase def test_nonexistant_custom_template_defaults_to_standard_template new_node = create_node_under_root "fnord" draft = find_or_create_draft(new_node, @user1) - draft.template_name = "huchibu" - draft.save + draft.update_column(:template_name, "huchibu") new_node.publish_draft! get :render_page, params: { :locale => 'de', :page_path => ["fnord"] } -- cgit v1.3