X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/3088521012dd7f5b88725240cebf163d7c8da31c..80b2655dbb69a4ceacce0a7f58845b3ee7fb5853:/apps/workbench/app/controllers/application_controller.rb

diff --git a/apps/workbench/app/controllers/application_controller.rb b/apps/workbench/app/controllers/application_controller.rb
index 04055f8485..c2636bf5d7 100644
--- a/apps/workbench/app/controllers/application_controller.rb
+++ b/apps/workbench/app/controllers/application_controller.rb
@@ -152,12 +152,12 @@ class ApplicationController < ActionController::Base
     if params[:filters]
       filters = params[:filters]
       if filters.is_a? String
-        filters = Oj.load filters
+        filters = Oj.safe_load filters
       elsif filters.is_a? Array
         filters = filters.collect do |filter|
           if filter.is_a? String
             # Accept filters[]=["foo","=","bar"]
-            Oj.load filter
+            Oj.safe_load filter
           else
             # Accept filters=[["foo","=","bar"]]
             filter
@@ -172,7 +172,7 @@ class ApplicationController < ActionController::Base
 
   def find_objects_for_index
     @objects ||= model_class
-    @objects = @objects.filter(@filters).limit(@limit).offset(@offset)
+    @objects = @objects.filter(@filters).limit(@limit).offset(@offset).order(@order)
     @objects.fetch_multiple_pages(false)
   end
 
@@ -361,7 +361,7 @@ class ApplicationController < ActionController::Base
     @updates.keys.each do |attr|
       if @object.send(attr).is_a? Hash
         if @updates[attr].is_a? String
-          @updates[attr] = Oj.load @updates[attr]
+          @updates[attr] = Oj.safe_load @updates[attr]
         end
         if params[:merge] || params["merge_#{attr}".to_sym]
           # Merge provided Hash with current Hash, instead of
@@ -417,7 +417,11 @@ class ApplicationController < ActionController::Base
       respond_to do |f|
         f.json { render json: @object }
         f.html {
-          redirect_to(params[:return_to] || :back)
+          if params[:return_to]
+            redirect_to(params[:return_to])
+          else
+            redirect_back(fallback_location: root_path)
+          end
         }
         f.js { render }
       end
@@ -519,7 +523,7 @@ class ApplicationController < ActionController::Base
       redirect_to arvados_api_client.arvados_login_url(return_to: strip_token_from_path(request.url))
     else
       flash[:error] = "Either you are not logged in, or your session has timed out. I can't automatically log you in and re-attempt this request."
-      redirect_to :back
+      redirect_back(fallback_location: root_path)
     end
     false  # For convenience to return from callbacks
   end
@@ -908,7 +912,8 @@ class ApplicationController < ActionController::Base
       pipelines.results.each { |pi| procs[pi] = pi.created_at }
     end
 
-    crs = ContainerRequest.limit(lim).with_count("none").order(["created_at desc"]).filter([["requesting_container_uuid", "=", nil]])
+    crs = ContainerRequest.limit(lim).with_count("none").order(["created_at desc"]).filter([["requesting_container_uuid", "=", nil]]).select(
+      ["uuid", "name", "container_uuid", "output_uuid", "state", "created_at", "modified_at"])
     crs.results.each { |c| procs[c] = c.created_at }
 
     Hash[procs.sort_by {|key, value| value}].keys.reverse.first(lim)
@@ -1240,7 +1245,7 @@ class ApplicationController < ActionController::Base
 
   # helper method to preload objects for given dataclass and uuids
   helper_method :preload_objects_for_dataclass
-  def preload_objects_for_dataclass dataclass, uuids, by_attr=nil
+  def preload_objects_for_dataclass dataclass, uuids, by_attr=nil, select_fields=nil
     @objects_for ||= {}
 
     raise ArgumentError, 'Argument is not a data class' unless dataclass.is_a? Class
@@ -1265,7 +1270,7 @@ class ApplicationController < ActionController::Base
       end
     else
       key_prefix = "request_#{Thread.current.object_id}_#{dataclass.to_s}_"
-      dataclass.where(uuid: uuids).each do |obj|
+      dataclass.where(uuid: uuids).select(select_fields).each do |obj|
         @objects_for[obj.uuid] = obj
         if dataclass == Collection
           # The collecions#index defaults to "all attributes except manifest_text"