Just spotted. An SQL injection vulnerability (through a value of session[:ward_id]):
On Feb 25, 12:00 am, Ali <[email protected]> wrote: > @profile = Profile.find(:all, :conditions => "ward_id = > '#{session[:ward_id]}'") and > �...@pro = Profile.find(:first, :conditions => "ward_id = > '#{session[:ward_id]}'") Change to: @profile = Profile.find(:all, :conditions => ["ward_id = ', session [:ward_id]]) and @pro = Profile.find(:first, :conditions => ["ward_id = ? ', session [:ward_id]]) It'll be much safer. Alfed --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "ActiveScaffold : Ruby on Rails plugin" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/activescaffold?hl=en -~----------~----~----~----~------~----~------~--~---
