[BUG] Exception 29/08/2024 at 10:42

Using params from ActionController::Parameters before permitting them
sanger · Oct 8, 2024 · 147e531 · 147e531
1 parent 1aecaea
commit 147e531
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/app/controllers/barcode_labels_controller.rb b/app/controllers/barcode_labels_controller.rb
@@ -27,7 +27,8 @@ def create
   private
 
   def generate_labels
-    @labels = (params[:numbers] || []).map do |_, number|
+    permitted_params = params.permit(:prefix, :study, :numbers)
+    @labels = (permitted_params[:numbers] || []).map do |_, number|
       BarcodeSheet::Label.new(
         prefix: params[:prefix],
         number:,