1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00

Fix merging relation that order including ?

The `Relation::Merger` has a problem that order values would be merged
as nested array.

That was caused an issue #33664 since if array value is passed to
`order` and first element in the array includes `?`, the array is
regarded as a prepared statement and bind variables.

https://api.rubyonrails.org/classes/ActiveRecord/Sanitization/ClassMethods.html#method-i-sanitize_sql_for_order

Just merging that as splat args like other values would fix the issue.

Fixes #33664.
This commit is contained in:
Ryuta Kamizono 2018-08-20 23:41:45 +09:00
parent ffca883908
commit 96cd16bdee
2 changed files with 12 additions and 2 deletions

View file

@ -152,10 +152,10 @@ module ActiveRecord
def merge_multi_values
if other.reordering_value
# override any order specified in the original relation
relation.reorder! other.order_values
relation.reorder!(*other.order_values)
elsif other.order_values.any?
# merge in order_values from relation
relation.order! other.order_values
relation.order!(*other.order_values)
end
extensions = other.extensions - relation.extensions

View file

@ -121,6 +121,16 @@ class RelationMergingTest < ActiveRecord::TestCase
relation = relation.merge(Post.from("posts"))
assert_not_empty relation.from_clause
end
def test_merging_with_order_with_binds
relation = Post.all.merge(Post.order([Arel.sql("title LIKE ?"), "%suffix"]))
assert_equal ["title LIKE '%suffix'"], relation.order_values
end
def test_merging_with_order_without_binds
relation = Post.all.merge(Post.order(Arel.sql("title LIKE '%?'")))
assert_equal ["title LIKE '%?'"], relation.order_values
end
end
class MergingDifferentRelationsTest < ActiveRecord::TestCase