From 27e2f481df50a09b1470452df330664cb0946f73 Mon Sep 17 00:00:00 2001 From: rulingcom Date: Sat, 24 Oct 2026 13:22:44 +0800 Subject: [PATCH] Escape user input before building regexps --- app/controllers/client_managements_controller.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/app/controllers/client_managements_controller.rb b/app/controllers/client_managements_controller.rb index 3a1bf21..c89ab26 100644 --- a/app/controllers/client_managements_controller.rb +++ b/app/controllers/client_managements_controller.rb @@ -82,12 +82,12 @@ class ClientManagementsController < CPanelController def site_tickets if params[:category].present? && params[:keyword].present? - regex = ::Regexp.new(".*" + params[:keyword] + ".*", "i") + regex = ::Regexp.new(".*" + Regexp.escape(params[:keyword].to_s) + ".*", "i") @tickets = @site_construct.tickets.where(:category_id => params[:category], :subject => regex).order_by([:status, :desc],[:created_at, :desc]).page(params[:page]).per(10) elsif params[:category].present? @tickets = @site_construct.tickets.where(:category_id => params[:category]).order_by([:status, :desc],[:created_at, :desc]).page(params[:page]).per(10) elsif params[:keyword].present? - regex = ::Regexp.new(".*" + params[:keyword] + ".*", "i") + regex = ::Regexp.new(".*" + Regexp.escape(params[:keyword].to_s) + ".*", "i") @tickets = @site_construct.tickets.where(:subject => regex).order_by([:status, :desc],[:created_at, :desc]).page(params[:page]).per(10) else @tickets = @site_construct.tickets.order_by([:status, :desc],[:created_at, :desc]).page(params[:page]).per(10)