From 93cc261752042c70ed158b76284e4e6c6948c30b Mon Sep 17 00:00:00 2001
From: rulingcom <orbit@rulingcom.com>
Date: Sat, 24 Oct 2026 13:17:16 +0800
Subject: [PATCH] Escape user input before building regexps

---
 app/controllers/admin/seminars_controller.rb                | 6 +++---
 .../app/controllers/custom_bulletins_controller.rb          | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/app/controllers/admin/seminars_controller.rb b/app/controllers/admin/seminars_controller.rb
index 34891f2..44ad583 100644
--- a/app/controllers/admin/seminars_controller.rb
+++ b/app/controllers/admin/seminars_controller.rb
@@ -175,7 +175,7 @@ class Admin::SeminarsController < OrbitAdminController
       @seminar_signup_admin_setting = SeminarSignupAdminSetting.create(:seminar_main_id=>"enquiry_for_applicants")
     end
     if params[:name].present?
-      @seminar_signups = SeminarSignup.where(:name => /#{params[:name]}/).sort_ordered.page(params[:page]).per(10)
+      @seminar_signups = SeminarSignup.where(:name => /#{Regexp.escape(params[:name].to_s)}/).sort_ordered.page(params[:page]).per(10)
     else
       @seminar_signups = []
     end
@@ -606,7 +606,7 @@ class Admin::SeminarsController < OrbitAdminController
       if params[:search].to_i != 0
         @seminar_signups = @seminar.seminar_signups.where(:serial_number=>params[:search].to_i)
       else
-        @seminar_signups = @seminar.seminar_signups.where(:name=>/#{params[:search]}/)
+        @seminar_signups = @seminar.seminar_signups.where(:name=>/#{Regexp.escape(params[:search].to_s)}/)
       end
     elsif params[:type] == "session"
       assigned_seminar_signups = @seminar.seminar_sessions.pluck(:seminar_signup_ids,:default_seminar_signup_ids).flatten
@@ -616,7 +616,7 @@ class Admin::SeminarsController < OrbitAdminController
       if @seminar.assign_mode != 0
         unassigned_seminar_signup_ids = @seminar.unassigned_mode_1_seminar_signup_ids
       end
-      @seminar_signups = @seminar.seminar_signups.where(:id.in => unassigned_seminar_signup_ids, :name=>/#{params[:search]}/)
+      @seminar_signups = @seminar.seminar_signups.where(:id.in => unassigned_seminar_signup_ids, :name=>/#{Regexp.escape(params[:search].to_s)}/)
     end
     OrbitHelper.set_params(params,current_user)
     @access_level = OrbitHelper.user_access_level?
diff --git a/custom_announcement/app/controllers/custom_bulletins_controller.rb b/custom_announcement/app/controllers/custom_bulletins_controller.rb
index a4134fc..833f911 100644
--- a/custom_announcement/app/controllers/custom_bulletins_controller.rb
+++ b/custom_announcement/app/controllers/custom_bulletins_controller.rb
@@ -12,7 +12,7 @@ class CustomBulletinsController < ApplicationController
 
     I18n.locale = :zh_tw
     if !params[:keyword].blank?
-      keyword = Regexp.new(".*"+params[:keyword]+".*")
+      keyword = Regexp.new(".*"+Regexp.escape(params[:keyword].to_s)+".*")
       custom_bulletins = CustomBulletin.any_of({:title=>keyword},{:subtitle=>keyword},{:text=>keyword})
     else
       custom_bulletins = CustomBulletin.all
@@ -20,7 +20,7 @@ class CustomBulletinsController < ApplicationController
 
     if !params[:category].blank?
       module_id = ModuleApp.where(:key=>"custom_announcement").first.id
-      category = Regexp.new(".*"+params[:category]+".*")
+      category = Regexp.new(".*"+Regexp.escape(params[:category].to_s)+".*")
       category_id = Category.where(:title => category, :module_app_id => module_id).first.id
       custom_bulletins = custom_bulletins.where(:category_id => category_id)
     else
@@ -83,7 +83,7 @@ class CustomBulletinsController < ApplicationController
 
     # 計算總筆數 Start
     if !params[:keyword].blank?
-      keyword = Regexp.new(".*"+params[:keyword]+".*")
+      keyword = Regexp.new(".*"+Regexp.escape(params[:keyword].to_s)+".*")
       custom_bulletin_count = CustomBulletin.any_of({:title=>keyword},{:subtitle=>keyword},{:text=>keyword})
     else
       custom_bulletin_count = CustomBulletin.all