Remove need for SQL injection

d1c45294 · Alex Kalderimis · e01dd08e · d1c45294
Commit d1c45294 authored Sep 09, 2020 by Alex Kalderimis
Show whitespace changes
Inline Side-by-side

Showing with 5 additions and 2 deletions

app/models/concerns/relative_positioning.rb app/models/concerns/relative_positioning.rb +5 -2

No files found.
--- a/app/models/concerns/relative_positioning.rb
+++ b/app/models/concerns/relative_positioning.rb
@@ -69,8 +69,11 @@ module RelativePositioning
    end

    def nextify(relation, gt = true)
-      op = gt ? '>' : '<'
-      relation.where("relative_position #{op} ?", object.relative_position)
+      if gt
+        relation.where("relative_position > ?", relative_position)
+      else
+        relation.where("relative_position < ?", relative_position)
+      end
    end

    def relative_siblings(relation = scoped_items)