4653: Permit :date_range filter param in DistributionsController#index

app/controllers/distributions_controller.rb

@@ -45,7 +45,7 @@ def index
                      .distributions
                      .includes(:partner, :storage_location, line_items: [:item])
                      .order('issued_at DESC')
-                     .apply_filters(filter_params, helpers.selected_range)
+                     .apply_filters(filter_params.except(:date_range), helpers.selected_range)
     @paginated_distributions = @distributions.page(params[:page])
     @items = current_organization.items.alphabetized
     @item_categories = current_organization.item_categories
@@ -310,7 +310,7 @@ def daily_items(pick_ups)
     def filter_params
     return {} unless params.key?(:filters)
 
-    params.require(:filters).permit(:by_item_id, :by_item_category_id, :by_partner, :by_state, :by_location)
+    params.require(:filters).permit(:by_item_id, :by_item_category_id, :by_partner, :by_state, :by_location, :date_range)
   end
 
   def perform_inventory_check

spec/requests/distributions_requests_spec.rb

@@ -70,6 +70,23 @@
         expect(response).to be_successful
       end
 
+      it "permits valid filter params" do
+        params = {
+          filters: {
+            by_item_id: 1,
+            by_item_category_id: 1,
+            by_partner: 1,
+            by_state: "NY",
+            by_location: 1,
+            date_range: "July 1, 1919 - July 31, 2020"
+          }
+        }
+
+        assert_not_logged("Unpermitted parameter") do
+          get distributions_path, params: params
+        end
+      end
+
       it "sums distribution totals accurately" do
         create(:distribution, :with_items, item_quantity: 5, organization: organization)
         create(:line_item, :distribution, itemizable_id: distribution.id, quantity: 7)

spec/support/log_helper.rb

@@ -0,0 +1,14 @@
+def assert_not_logged(message)
+  old_logger = ActionController::Base.logger
+  log = StringIO.new
+  ActionController::Base.logger = Logger.new(log)
+
+  begin
+    yield
+
+    log.rewind
+    expect(log.read).not_to match(message)
+  ensure
+    ActionController::Base.logger = old_logger
+  end
+end