Security patch for Kaminari 1.2.0 not longer needed.

Kaminari released version 1.2.1 fixing CVE-2020-11082, where an attacker would be able to inject arbitrary code into pages with pagination links. Proof: kaminari/kaminari#1020 https://my.diffend.io/gems/kaminari/1.2.0/1.2.1 The changes for Kaminari 1.2.1 makes the patching on the config/initializer/kaminari_config.rb not longer needed.
esparta · Jun 17, 2020 · 06abbb5 · 06abbb5
1 parent 97b1703
commit 06abbb5
Show file tree

Hide file tree

Showing 3 changed files with 2 additions and 6 deletions.
diff --git a/Gemfile b/Gemfile
@@ -17,7 +17,7 @@ gem "high_voltage"
 gem "honeybadger"
 gem "http_accept_language"
 gem "jquery-rails"
-gem "kaminari"
+gem "kaminari", "~> 1.2.1"
 gem "mail"
 gem "newrelic_rpm"
 gem "paul_revere", "~> 3.1.0"

diff --git a/Gemfile.lock b/Gemfile.lock
@@ -433,7 +433,7 @@ DEPENDENCIES
   honeybadger
   http_accept_language
   jquery-rails
-  kaminari
+  kaminari (~> 1.2.1)
   launchy
   listen
   lograge

diff --git a/config/initializers/kaminari_config.rb b/config/initializers/kaminari_config.rb
@@ -11,7 +11,3 @@
   # config.param_name = :page
   # config.params_on_first_page = false
 end
-
-module Kaminari::Helpers
-  PARAM_KEY_EXCEPT_LIST = %i[authenticity_token commit utf8 _method script_name original_script_name].freeze
-end