Added fix for Analytics SQLi

app/controllers/admin_controller.rb

@@ -7,11 +7,11 @@ class AdminController < ApplicationController
   end
 
   def analytics
-
     if params[:field].nil?
       fields = "*"
     else
-      fields = params[:field].map {|k,v| k}.join(",")
+      #fields = params[:field].map {|k,v| k }.join(",")
+      fields = params[:field].map {|k,v| Analytics.parse_field(k) }.join(",")
     end
 
     if params[:ip]

app/models/analytics.rb

@@ -1,9 +1,19 @@
 class Analytics < ActiveRecord::Base
   attr_accessible :ip_address, :referrer, :user_agent
 
-  scope :hits_by_ip, ->(ip,col="*") { select("#{col}").where("ip_address = '#{ip}'")}
+  scope :hits_by_ip, ->(ip,col="*") { select("#{col}").where(:ip_address => ip).order("id DESC")}
 
   def self.count_by_col(col)
   	calculate(:count, col)
   end
+
+  def self.parse_field(field)
+  	valid_fields = ["ip_address", "referrer", "user_agent"]
+
+  	if valid_fields.include?(field)
+  		field
+  	else
+  		"1"
+  	end
+  end
 end