From 339d8e46ff1d5d58beb1d66e5be842b63bf858f6 Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Sun, 4 Jun 2017 19:57:27 +0100 Subject: [PATCH 1/1] Sanitise parameters used in URL generation --- app/controllers/geocoder_controller.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/app/controllers/geocoder_controller.rb b/app/controllers/geocoder_controller.rb index 234842588..6ec2d46f8 100644 --- a/app/controllers/geocoder_controller.rb +++ b/app/controllers/geocoder_controller.rb @@ -160,7 +160,9 @@ class GeocoderController < ApplicationController @results = [] # create parameter hash for "more results" link - @more_params = params.merge(:exclude => more_url_params["exclude_place_ids"].first) + @more_params = params + .permit(:query, :minlon, :minlat, :maxlon, :maxlat, :exclude) + .merge(:exclude => more_url_params["exclude_place_ids"].first) # parse the response results.elements.each("place") do |place| -- 2.43.2