Fix brakeman

roschaefer · Jul 31, 2018 · 61ee7d2 · 61ee7d2
1 parent e2ec18e
commit 61ee7d2
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/backend/app/controllers/statistic/broadcasts_controller.rb b/backend/app/controllers/statistic/broadcasts_controller.rb
@@ -51,6 +51,7 @@ def index
       }
       direction = order_mapping[statistics_params[:direction]] || 'DESC NULLS LAST'
       order_by_clause = [column, direction].join(' ')
+      order_by_clause = ActiveRecord::Base.sanitize(order_by_clause)
 
       @statistics = Statistic::Broadcast.order(order_by_clause).order(title: :asc).page(page).per(per_page)
       render json: @statistics, meta: { total_pages: @statistics.total_pages }