Fix vulnerable.

app/controllers/admin/application_forms_controller.rb

@@ -380,14 +380,15 @@ class Admin::ApplicationFormsController < OrbitAdminController
     @categories = @module_app.categories.enabled
     @filter_fields = filter_fields(@categories)
     @table_fields = [:category, 'application_form.title', 'application_form.event_during', 'application_form.signup_count', 'application_form.export']
-
-    if !params[:sort].blank? 
+    params_sort = params[:sort].to_s
+    if params_sort.present?
+      params_order = params[:order].to_s
       if params[:sort] == 'event_during'
-        sort = {:application_form_start_date.to_sym=>params[:order]} 
+        sort = {:application_form_start_date=>params_order}
       elsif params[:sort] == 'signup_during'
-        sort = {:application_form_start_date.to_sym=>params[:order]} 
+        sort = {:application_form_start_date=>params_order}
       else
-        sort = {params[:sort].to_sym=>params[:order]} 
+        sort = {params_sort=>params_order}
       end
     else
       sort = {:application_form_start_date=>"desc",:created_at=>"desc"}