Merge pull request #163 from publify/limit-seo-controller-params

Limit allowed SEO settings params
publify · Oct 13, 2024 · 47ba1e4 · 47ba1e4
2 parents 21f3f86 + f6ac3db
commit 47ba1e4
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/app/controllers/admin/seo_controller.rb b/app/controllers/admin/seo_controller.rb
@@ -30,7 +30,11 @@ def update
   private
 
   def settings_params
-    @settings_params ||= params.require(:setting).permit!
+    @settings_params ||= params.require(:setting).permit(settings_keys)
+  end
+
+  def settings_keys
+    @setting.settings_keys + [:custom_permalink]
   end
 
   VALID_SECTIONS = %w(general titles permalinks).freeze