From 93ee8899a05cd36195ff0c15fe9c784a03c13102 Mon Sep 17 00:00:00 2001
From: Jorge Manrubia <jorge@hey.com>
Date: Fri, 21 Nov 2025 10:38:16 +0100
Subject: [PATCH] More robust implementation to prevent method injection
 attacks

---
 .../events/day_timeline/columns_controller.rb | 14 +++++++--
 .../day_timeline/columns_controller_test.rb   | 30 +++++++++++++++++++
 2 files changed, 41 insertions(+), 3 deletions(-)
 create mode 100644 test/controllers/events/day_timeline/columns_controller_test.rb

diff --git a/app/controllers/events/day_timeline/columns_controller.rb b/app/controllers/events/day_timeline/columns_controller.rb
index 6cc00c08c..db30c44d1 100644
--- a/app/controllers/events/day_timeline/columns_controller.rb
+++ b/app/controllers/events/day_timeline/columns_controller.rb
@@ -1,13 +1,21 @@
 class Events::DayTimeline::ColumnsController < ApplicationController
   include DayTimelinesScoped
 
+  before_action :ensure_valid_column
+  before_action :set_column
+
   def show
-    @column = column_for_id(params[:id])
     fresh_when @day_timeline
   end
 
   private
-    def column_for_id(id)
-      @day_timeline.try("#{id}_column") or head :not_found
+    VALID_COLUMNS = %w[ added updated closed ]
+
+    def ensure_valid_column
+      head :not_found unless VALID_COLUMNS.include?(params[:id])
+    end
+
+    def set_column
+      @column = @day_timeline.public_send("#{params[:id]}_column")
     end
 end
diff --git a/test/controllers/events/day_timeline/columns_controller_test.rb b/test/controllers/events/day_timeline/columns_controller_test.rb
new file mode 100644
index 000000000..9ee459cbd
--- /dev/null
+++ b/test/controllers/events/day_timeline/columns_controller_test.rb
@@ -0,0 +1,30 @@
+require "test_helper"
+
+class Events::DayTimeline::ColumnsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    sign_in_as :kevin
+  end
+
+  test "show added column" do
+    get events_day_timeline_column_path("added")
+    assert_response :success
+    assert_select "h1", text: /Added/
+  end
+
+  test "show updated column" do
+    get events_day_timeline_column_path("updated")
+    assert_response :success
+    assert_select "h1", text: /Updated/
+  end
+
+  test "show closed column" do
+    get events_day_timeline_column_path("closed")
+    assert_response :success
+    assert_select "h1", text: /Closed/
+  end
+
+  test "show returns not found for invalid column" do
+    get events_day_timeline_column_path("invalid")
+    assert_response :not_found
+  end
+end