Disallow author and anonymous inbox filter combination

Retrospring · Jan 25, 2024 · b96651f · b96651f
1 parent 134c575
commit b96651f
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/app/models/inbox_filter.rb b/app/models/inbox_filter.rb
@@ -10,6 +10,10 @@ class InboxFilter
     anonymous
   ].freeze
 
+  FORBIDDEN_PARAM_GROUPS = [
+    %i[author anonymous]
+  ].freeze
+
   attr_reader :params, :user
 
   def initialize(user, params)
@@ -18,6 +22,8 @@ def initialize(user, params)
   end
 
   def results
+    return Inbox.none unless valid_params?
+
     scope = @user.inboxes
                  .includes(:question, user: :profile)
                  .order(:created_at)
@@ -32,6 +38,10 @@ def results
 
   private
 
+  def valid_params?
+    FORBIDDEN_PARAM_GROUPS.none? { |combination| combination.all? { |key| params.key?(key) } }
+  end
+
   def scope_for(key, value)
     case key.to_s
     when "author"