Skip to content

Commit

Permalink
Avoid 'Cannot redirect to a parameter hash' error
Browse files Browse the repository at this point in the history
Rails 4 introduced a [protection against passing parameters hash into
`redirect_to`](rails/rails#16170) as a security
measure.

In some circumstances the `session[:document_filters]` could contain a
paramters hash (I suspect this may only be the case for a session which
was serialized into someones session cookie in the pre-rails-4 whitehall
app and deserialized in this release).

Adding this `.to_h` forces the hash to always be converted to a ruby
hash.

It's safe to pass these parameters to redirect_to because they are all
features which are intended to be controlled by user input. The redirect
is just a feature to ensure consistency of urls.
  • Loading branch information
heathd committed Feb 18, 2015
1 parent ec8140e commit 0bbb477
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 2 deletions.
2 changes: 1 addition & 1 deletion app/controllers/admin/edition_workflow_controller.rb
Original file line number Diff line number Diff line change
Expand Up @@ -214,6 +214,6 @@ def action_name_as_human_interaction(action_name)
end

def session_filters
session[:document_filters] || {}
(session[:document_filters] || {}).to_h
end
end
2 changes: 1 addition & 1 deletion app/controllers/admin/editions_controller.rb
Original file line number Diff line number Diff line change
Expand Up @@ -305,7 +305,7 @@ def default_filters
end

def session_filters
session[:document_filters] || {}
(session[:document_filters] || {}).to_h
end

def params_filters
Expand Down

1 comment on commit 0bbb477

@tekin
Copy link
Contributor

@tekin tekin commented on 0bbb477 Feb 19, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Gah, I thought I'd fixed this one...

Please sign in to comment.