Merge branch 'add-test-case-for-a1-field-injection' of https://github.com/jmmastey/railsgoat into jmmastey-add-test-case-for-a1-field-injection

app/controllers/admin_controller.rb

@@ -9,7 +9,7 @@ class AdminController < ApplicationController
     if params[:field].nil?
       fields = "*"
     else
-      fields = params[:field].map {|k,v| k }.join(",")
+      fields = custom_fields.join(",")
     end
 
     if params[:ip]
@@ -60,6 +60,11 @@ class AdminController < ApplicationController
 
   private
 
+  def custom_fields
+    params.require(:field).keys
+  end
+  helper_method :custom_fields
+
   def admin_param
     params[:admin_id] != '1'
   end

app/views/admin/analytics.html.erb

@@ -1,18 +1,18 @@
-<form action="">
-  Search by IP: <input type="text" name="ip"><br />
-  <input type="checkbox" value="" name="field[ip_address]"> IP Address<br />
-  <input type="checkbox" value="" name="field[referrer]"> Referrer<br />
-  <input type="checkbox" value="" name="field[user_agent]"> User Agent
+<form action="" id="analytics_search">
+  Search by IP: <input type="text" id="ip" name="ip"><br />
+  <input type="checkbox" value="" id="field_ip_address" name="field[ip_address]"> IP Address<br />
+  <input type="checkbox" value="" id="field_referrer" name="field[referrer]"> Referrer<br />
+  <input type="checkbox" value="" id="field_user_agent" name="field[user_agent]"> User Agent
 </form>
 
 <div id="dt_example" class="example_alt_pagination">
-    <table class="table table-striped table-hover table-bordered pull-left" id="data-table">
+    <table class="table table-striped table-hover table-bordered pull-left <%= "custom" if params[:field] %>" id="data-table">
       <thead>
         <tr>
           <%
-          count = (params[:field] ? params[:field].count : 3)
+          count = (params[:field] ? (custom_fields.count+1) : 6)
           count.times do %>
-          <td>&nbsp;</td>
+          <th>&nbsp;</th>
           <% end %>
         </tr>
       </thead>
@@ -33,6 +33,8 @@
   </div>
 </div>
 
+<%= javascript_include_tag "jquery.dataTables.js"%>
+
 <script type="text/javascript">
 
 function dataTablePagination(){
@@ -42,4 +44,4 @@ function dataTablePagination(){
 };
 
 $(document).ready(dataTablePagination());
-</script>
+</script>