X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/86660414472d4ff0d8267f9845a753497bd41692..2f83fcd45b4b23db2bb5bb4afbe1e863ebd77ec6:/apps/workbench/app/controllers/actions_controller.rb?ds=sidebyside

diff --git a/apps/workbench/app/controllers/actions_controller.rb b/apps/workbench/app/controllers/actions_controller.rb
index df489d2eeb..7b8c8eafc8 100644
--- a/apps/workbench/app/controllers/actions_controller.rb
+++ b/apps/workbench/app/controllers/actions_controller.rb
@@ -167,7 +167,7 @@ class ActionsController < ApplicationController
     flash = {}
 
     # set owner_uuid to current project, provided it is writable
-    action_data = Oj.load(params['action_data'] || "{}")
+    action_data = Oj.safe_load(params['action_data'] || "{}")
     if action_data['current_project_uuid'] and
         current_project = Group.find?(action_data['current_project_uuid']) and
         current_project.writable_by.andand.include?(current_user.uuid)