相关疑难解决方法(0)

Rails 5.0.0.beta1 - 从非清理的请求参数生成URL是不安全的

我们正在从Rails 4.2.5升级到5.0.0.beta1

在测试时,我们希望看到像以前一样使用分页链接呈现的索引视图.但是我们现在得到一个ArgumentError错误页面,例如:

ArgumentError in Transactions#index 
/app/views/kaminari/_paginator.html.erb where line #10 raised:


<%= paginator.render do -%>

Generating an URL from non sanitized request parameters is insecure!

Application Trace | Framework Trace | Full Trace

app/views/kaminari/_paginator.html.erb:10:in block in _app_views_kaminari__paginator_html_erb___4026289994022119719_69904100316060' app/views/kaminari/_paginator.html.erb:9:in_app_views_kaminari__paginator_html_erb___4026289994022119719_69904100316060'
app/views/transactions/index.html.erb:2:in `_app_views_transactions_index_html_erb__422882858554400818_60602560'
Run Code Online (Sandbox Code Playgroud)

kaminari提出了一个问题

进一步研究这里是新的Rails 5.0.0.beta1代码,现在抛出错误: ActionPack的/ lib目录/ action_dispatch /路由/ url_for.rb

将它添加到config/application.rb'修复'它,但不是一个好主意:

config.action_controller.permit_all_parameters = true
Run Code Online (Sandbox Code Playgroud)

而是添加这个并不能解决问题,不确定原因:

config.action_controller.always_permitted_parameters =  [:current_page, :page, :total_pages, :per_page, :remote, :paginator]
Run Code Online (Sandbox Code Playgroud)

ruby-on-rails upgrade sanitize kaminari ruby-on-rails-5

17
推荐指数
1
解决办法
3543
查看次数