Whitelist parameters for return_authorizations filtering

spree · Dec 20, 2021 · d0b6380 · d0b6380
1 parent 0151174
commit d0b6380
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/app/views/spree/admin/return_index/return_authorizations.html.erb b/app/views/spree/admin/return_index/return_authorizations.html.erb
@@ -10,12 +10,12 @@
   </li>
   <li class="nav-item">
     <%= link_to Spree.t(:authorized),
-      params.merge({q: {state_eq: :authorized}}).permit!,
+      params.permit(q: {}).merge({q: {state_eq: :authorized}}),
       class: "nav-link #{'active' if params[:q][:state_eq] == 'authorized'}" %>
   </li>
   <li class="nav-item">
     <%= link_to Spree.t(:canceled),
-      params.merge({q: {state_eq: :canceled}}).permit!,
+      params.permit(q: {}).merge({q: {state_eq: :canceled}}),
       class: "nav-link #{'active' if params[:q][:state_eq] == 'canceled'}" %>
   </li>
 <% end %>