X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/1586823b65c7ec7656626e491a31f3f9516a4a56..267c02294d7d5c1f161921f9dade6b692a7029a2:/services/api/lib/load_param.rb

diff --git a/services/api/lib/load_param.rb b/services/api/lib/load_param.rb
index e3de05f24f..9a360c538b 100644
--- a/services/api/lib/load_param.rb
+++ b/services/api/lib/load_param.rb
@@ -1,3 +1,7 @@
+# Copyright (C) The Arvados Authors. All rights reserved.
+#
+# SPDX-License-Identifier: AGPL-3.0
+
 # Mixin module for reading out query parameters from request params.
 #
 # Expects:
@@ -13,7 +17,7 @@ module LoadParam
   def load_where_param
     if params[:where].nil? or params[:where] == ""
       @where = {}
-    elsif params[:where].is_a? Hash
+    elsif [Hash, ActionController::Parameters].include? params[:where].class
       @where = params[:where]
     elsif params[:where].is_a? String
       begin
@@ -46,13 +50,13 @@ module LoadParam
 
   # Load params[:limit], params[:offset] and params[:order]
   # into @limit, @offset, @orders
-  def load_limit_offset_order_params
+  def load_limit_offset_order_params(fill_table_names: true)
     if params[:limit]
       unless params[:limit].to_s.match(/^\d+$/)
         raise ArgumentError.new("Invalid value for limit parameter")
       end
       @limit = [params[:limit].to_i,
-                Rails.configuration.max_items_per_response].min
+                Rails.configuration.API.MaxItemsPerResponse].min
     else
       @limit = DEFAULT_LIMIT
     end
@@ -92,10 +96,14 @@ module LoadParam
         # has used set_table_name to use an alternate table name from the Rails standard.
         # I could not find a perfect way to handle this well, but ActiveRecord::Base.send(:descendants)
         # would be a place to start if this ever becomes necessary.
-        if attr.match(/^[a-z][_a-z0-9]+$/) and
-            model_class.columns.collect(&:name).index(attr) and
-            ['asc','desc'].index direction.downcase
-          @orders << "#{table_name}.#{attr} #{direction.downcase}"
+        if (attr.match(/^[a-z][_a-z0-9]+$/) &&
+            model_class.columns.collect(&:name).index(attr) &&
+            ['asc','desc'].index(direction.downcase))
+          if fill_table_names
+            @orders << "#{table_name}.#{attr} #{direction.downcase}"
+          else
+            @orders << "#{attr} #{direction.downcase}"
+          end
         elsif attr.match(/^([a-z][_a-z0-9]+)\.([a-z][_a-z0-9]+)$/) and
             ['asc','desc'].index(direction.downcase) and
             ActiveRecord::Base.connection.tables.include?($1) and
@@ -137,19 +145,23 @@ module LoadParam
       end
     end
 
+    @distinct = params[:distinct] && true
+  end
+
+  def load_select_param
     case params[:select]
     when Array
       @select = params[:select]
     when String
       begin
         @select = SafeJSON.load(params[:select])
-        raise unless @select.is_a? Array or @select.nil?
+        raise unless @select.is_a? Array or @select.nil? or !@select
       rescue
         raise ArgumentError.new("Could not parse \"select\" param as an array")
       end
     end
 
-    if @select
+    if @select && @orders
       # Any ordering columns must be selected when doing select,
       # otherwise it is an SQL error, so filter out invaliding orderings.
       @orders.select! { |o|
@@ -158,9 +170,6 @@ module LoadParam
         @select.select { |s| col == "#{table_name}.#{s}" }.any?
       }
     end
-
-    @distinct = true if (params[:distinct] == true || params[:distinct] == "true")
-    @distinct = false if (params[:distinct] == false || params[:distinct] == "false")
   end
 
 end