Ruby on Rails | Screencasts | Download | Documentation | Weblog | Community | Source

Ticket #6542: sql_creation_injection_points.diff

File sql_creation_injection_points.diff, 4.5 kB (added by ymendel, 10 months ago)

Updated diff (some changes happen in 11 months)

  • base.rb

    old new  
    14611461          end 
    14621462        end 
    14631463 
     1464        def create_scope_to_object(object) #:nodoc: 
     1465          scope(:create).each { |att,value| object.send("#{att}=", value) } if scoped?(:create) 
     1466        end 
     1467 
    14641468        def thread_safe_scoped_methods #:nodoc: 
    14651469          scoped_methods = (Thread.current[:scoped_methods] ||= {}) 
    14661470          scoped_methods[self] ||= [] 
    …… 
    16531657        @new_record = true 
    16541658        ensure_proper_type 
    16551659        self.attributes = attributes unless attributes.nil? 
    1656         self.class.send(:scope, :create).each { |att,value| self.send("#{att}=", value) } if self.class.send(:scoped?, :create) 
     1660        self.class.send(:create_scope_to_object, self) 
    16571661        result = yield self if block_given? 
    16581662        callback(:after_initialize) if respond_to_without_attributes?(:after_initialize) 
    16591663        result 
    …… 
    17111715      # be made (since they can't be persisted). 
    17121716      def destroy 
    17131717        unless new_record? 
    1714           connection.delete <<-end_sql, "#{self.class.name} Destroy" 
    1715             DELETE FROM #{self.class.table_name} 
    1716             WHERE #{connection.quote_column_name(self.class.primary_key)} = #{quoted_id} 
    1717           end_sql 
     1718          connection.delete(sql_for_destroy, "#{self.class.name} Destroy") 
    17181719        end 
    17191720 
    17201721        freeze 
    17211722      end 
    17221723 
     1724      def sql_for_destroy #:nodoc: 
     1725        "DELETE FROM #{self.class.table_name} #{sql_for_destroy_conditions}" 
     1726      end 
     1727 
     1728      def sql_for_destroy_conditions #:nodoc: 
     1729        "WHERE #{self.class.primary_key} = #{quoted_id}" 
     1730      end 
     1731 
    17231732      # Returns a clone of the record that hasn't been assigned an id yet and 
    17241733      # is treated as a new record.  Note that this is a "shallow" clone: 
    17251734      # it copies the object's attributes only, not its associations. 
    …… 
    19511960      # Updates the associated record with values matching those of the instance attributes. 
    19521961      # Returns the number of affected rows. 
    19531962      def update 
    1954         connection.update( 
    1955           "UPDATE #{self.class.table_name} " + 
    1956           "SET #{quoted_comma_pair_list(connection, attributes_with_quotes(false))} " + 
    1957           "WHERE #{connection.quote_column_name(self.class.primary_key)} = #{quote_value(id)}", 
    1958           "#{self.class.name} Update" 
    1959         ) 
     1963        connection.update(sql_for_update, "#{self.class.name} Update") 
    19601964      end 
    19611965 
     1966      def sql_for_update #:nodoc: 
     1967        "UPDATE #{self.class.table_name} #{sql_for_update_values} #{sql_for_update_conditions}" 
     1968      end 
     1969 
     1970      def sql_for_update_values #:nodoc: 
     1971        "SET #{quoted_comma_pair_list(connection, attributes_for_update)}" 
     1972      end 
     1973 
     1974      def attributes_for_update #:nodoc: 
     1975        attributes_with_quotes(false) 
     1976      end 
     1977 
     1978      def sql_for_update_conditions #:nodoc: 
     1979        "WHERE #{self.class.primary_key} = #{quote_value(id)}" 
     1980      end 
     1981 
    19621982      # Creates a record with values matching those of the instance attributes 
    19631983      # and returns its id. 
    19641984      def create 
    …… 
    19661986          self.id = connection.next_sequence_value(self.class.sequence_name) 
    19671987        end 
    19681988 
    1969         self.id = connection.insert( 
    1970           "INSERT INTO #{self.class.table_name} " + 
    1971           "(#{quoted_column_names.join(', ')}) " + 
    1972           "VALUES(#{attributes_with_quotes.values.join(', ')})", 
    1973           "#{self.class.name} Create", 
     1989        self.id = connection.insert(sql_for_create, "#{self.class.name} Create", 
    19741990          self.class.primary_key, self.id, self.class.sequence_name 
    19751991        ) 
    19761992 
    …… 
    19781994        id 
    19791995      end 
    19801996 
     1997      def sql_for_create #:nodoc: 
     1998        "INSERT INTO #{self.class.table_name} " +  
     1999        "(#{columns_for_create.join(', ')}) " + 
     2000        "VALUES(#{attributes_for_create.values.join(', ')})" 
     2001      end 
     2002 
    19812003      # Sets the attribute used for single table inheritance to this class name if this is not the ActiveRecord descendent. 
    19822004      # Considering the hierarchy Reply < Message < ActiveRecord, this makes it possible to do Reply.new without having to 
    19832005      # set Reply[Reply.inheritance_column] = "Reply" yourself. No such attribute would be set for objects of the 
    …… 
    21172139        end 
    21182140      end 
    21192141 
     2142      alias_method :columns_for_create,    :quoted_column_names 
     2143      alias_method :attributes_for_create, :attributes_with_quotes 
     2144 
    21202145      def quote_columns(quoter, hash) 
    21212146        hash.inject({}) do |quoted, (name, value)| 
    21222147          quoted[quoter.quote_column_name(name)] = value