Merge branch 'hotfix/4.11.2' into develop

app/helpers/filters/filter_helper.rb

@@ -47,11 +47,15 @@ module Filters::FilterHelper
 
   def handle_additional_attributes(query_hash, filter_operator_value, data_type)
     if data_type == 'text_case_insensitive'
-      "LOWER(#{filter_config[:table_name]}.additional_attributes ->> '#{query_hash[:attribute_key]}') " \
-        "#{filter_operator_value} #{query_hash[:query_operator]}"
+      ActiveRecord::Base.sanitize_sql_array(
+        ["LOWER(#{filter_config[:table_name]}.additional_attributes ->> ?) #{filter_operator_value} #{query_hash[:query_operator]}",
+         query_hash[:attribute_key]]
+      )
     else
-      "#{filter_config[:table_name]}.additional_attributes ->> '#{query_hash[:attribute_key]}' " \
-        "#{filter_operator_value} #{query_hash[:query_operator]} "
+      ActiveRecord::Base.sanitize_sql_array(
+        ["#{filter_config[:table_name]}.additional_attributes ->> ? #{filter_operator_value} #{query_hash[:query_operator]} ",
+         query_hash[:attribute_key]]
+      )
     end
   end
 
@@ -70,7 +74,7 @@ module Filters::FilterHelper
 
   def date_filter(current_filter, query_hash, filter_operator_value)
     "(#{filter_config[:table_name]}.#{query_hash[:attribute_key]})::#{current_filter['data_type']} " \
-      "#{filter_operator_value}#{current_filter['data_type']} #{query_hash[:query_operator]}"
+      "#{filter_operator_value} #{query_hash[:query_operator]}"
   end
 
   def text_case_insensitive_filter(query_hash, filter_operator_value)

app/models/custom_attribute_definition.rb

@@ -30,10 +30,12 @@ class CustomAttributeDefinition < ApplicationRecord
 
   scope :with_attribute_model, ->(attribute_model) { attribute_model.presence && where(attribute_model: attribute_model) }
   validates :attribute_display_name, presence: true
+  before_validation :normalize_attribute_fields
 
   validates :attribute_key,
             presence: true,
-            uniqueness: { scope: [:account_id, :attribute_model] }
+            uniqueness: { scope: [:account_id, :attribute_model] },
+            format: { with: /\A[\p{L}\p{N}_.\-]+\z/, message: I18n.t('errors.custom_attribute_definition.attribute_key_format') }
 
   validates :attribute_display_type, presence: true
   validates :attribute_model, presence: true
@@ -48,6 +50,11 @@ class CustomAttributeDefinition < ApplicationRecord
 
   private
 
+  def normalize_attribute_fields
+    self.attribute_key = attribute_key.strip if attribute_key.present?
+    self.attribute_display_name = attribute_display_name.strip if attribute_display_name.present?
+  end
+
   def sync_widget_pre_chat_custom_fields
     ::Inboxes::SyncWidgetPreChatCustomFieldsJob.perform_later(account, attribute_key)
   end

app/services/filter_service.rb

@@ -33,9 +33,9 @@ class FilterService
     when 'is_not_present'
       @filter_values["value_#{current_index}"] = 'IS NULL'
     when 'is_greater_than', 'is_less_than'
-      @filter_values["value_#{current_index}"] = lt_gt_filter_values(query_hash)
+      lt_gt_filter_query(query_hash, current_index)
     when 'days_before'
-      @filter_values["value_#{current_index}"] = days_before_filter_values(query_hash)
+      days_before_filter_query(query_hash, current_index)
     else
       @filter_values["value_#{current_index}"] = filter_values(query_hash).to_s
       "= :value_#{current_index}"
@@ -81,21 +81,29 @@ class FilterService
     query_hash['values'].downcase
   end
 
-  def lt_gt_filter_values(query_hash)
+  def lt_gt_filter_query(query_hash, current_index)
     attribute_key = query_hash[:attribute_key]
     attribute_model = query_hash['custom_attribute_type'].presence || self.class::ATTRIBUTE_MODEL
     attribute_type = custom_attribute(attribute_key, @account, attribute_model).try(:attribute_display_type)
-    attribute_data_type = self.class::ATTRIBUTE_TYPES[attribute_type]
-    value = query_hash['values'][0]
+    attribute_data_type = self.class::ATTRIBUTE_TYPES[attribute_type] || standard_attribute_data_type(attribute_key)
+
+    @filter_values["value_#{current_index}"] = coerce_lt_gt_value(
+      query_hash['values'][0],
+      attribute_data_type,
+      attribute_key
+    )
     operator = query_hash['filter_operator'] == 'is_less_than' ? '<' : '>'
-    "#{operator} '#{value}'::#{attribute_data_type}"
+    "#{operator} :value_#{current_index}"
   end
 
-  def days_before_filter_values(query_hash)
+  def days_before_filter_query(query_hash, current_index)
     date = Time.zone.today - query_hash['values'][0].to_i.days
-    query_hash['values'] = [date.strftime]
-    query_hash['filter_operator'] = 'is_less_than'
-    lt_gt_filter_values(query_hash)
+    updated_query_hash = query_hash.with_indifferent_access.merge(
+      values: [date.strftime],
+      filter_operator: 'is_less_than'
+    )
+
+    lt_gt_filter_query(updated_query_hash, current_index)
   end
 
   def set_count_for_all_conversations
@@ -149,15 +157,39 @@ class FilterService
     @attribute_data_type = self.class::ATTRIBUTE_TYPES[attribute_type]
   end
 
+  def standard_attribute_data_type(attribute_key)
+    @filters.each_value do |section|
+      return section.dig(attribute_key, 'data_type') if section.is_a?(Hash) && section.key?(attribute_key)
+    end
+    nil
+  end
+
+  def coerce_lt_gt_value(raw_value, attribute_data_type, attribute_key)
+    case attribute_data_type
+    when 'date'
+      Date.iso8601(raw_value.to_s)
+    when 'numeric'
+      BigDecimal(raw_value.to_s)
+    else
+      raise CustomExceptions::CustomFilter::InvalidValue.new(attribute_name: attribute_key)
+    end
+  rescue Date::Error, ArgumentError, FloatDomainError, TypeError
+    raise CustomExceptions::CustomFilter::InvalidValue.new(attribute_name: attribute_key)
+  end
+
   def build_custom_attr_query(query_hash, current_index)
     filter_operator_value = filter_operation(query_hash, current_index)
     query_operator = query_hash[:query_operator]
     table_name = attribute_model == 'conversation_attribute' ? 'conversations' : 'contacts'
 
     query = if attribute_data_type == 'text'
-              "LOWER(#{table_name}.custom_attributes ->> '#{@attribute_key}')::#{attribute_data_type} #{filter_operator_value} #{query_operator} "
+              ActiveRecord::Base.sanitize_sql_array(
+                ["LOWER(#{table_name}.custom_attributes ->> ?)::#{attribute_data_type} #{filter_operator_value} #{query_operator} ", @attribute_key]
+              )
             else
-              "(#{table_name}.custom_attributes ->> '#{@attribute_key}')::#{attribute_data_type} #{filter_operator_value} #{query_operator} "
+              ActiveRecord::Base.sanitize_sql_array(
+                ["(#{table_name}.custom_attributes ->> ?)::#{attribute_data_type} #{filter_operator_value} #{query_operator} ", @attribute_key]
+              )
             end
 
     query + not_in_custom_attr_query(table_name, query_hash, attribute_data_type)
@@ -174,7 +206,9 @@ class FilterService
   def not_in_custom_attr_query(table_name, query_hash, attribute_data_type)
     return '' unless query_hash[:filter_operator] == 'not_equal_to'
 
-    " OR (#{table_name}.custom_attributes ->> '#{@attribute_key}')::#{attribute_data_type} IS NULL "
+    ActiveRecord::Base.sanitize_sql_array(
+      [" OR (#{table_name}.custom_attributes ->> ?)::#{attribute_data_type} IS NULL ", @attribute_key]
+    )
   end
 
   def equals_to_filter_string(filter_operator, current_index)