Add sql injection

machadoit · Sep 15, 2015 · 0edca15 · 0edca15
1 parent 159ab80
commit 0edca15
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
@@ -3,6 +3,7 @@ def new
   end
 
   def create
+    User.first(:conditions => "username = '#{params[:username]}'")
     user = User.find_by(email: params[:session][:email].downcase)
     if user && user.authenticate(params[:session][:password])
       log_in user