fix the sql injection brakeman warning

ManageIQ · May 6, 2020 · d813ed2 · d813ed2
1 parent 927b99f
commit d813ed2
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/app/models/mixins/aggregation_mixin/methods.rb b/app/models/mixins/aggregation_mixin/methods.rb
@@ -43,7 +43,7 @@ def aggregate_hardware(from, field, targets = nil)
       select    = field == :aggregate_cpu_speed ? "cpu_total_cores, cpu_speed" : field
       targets ||= send("all_#{from}_ids")
       targets   = targets.collect(&:id) unless targets.first.kind_of?(Integer)
-      hdws      = Hardware.where("#{from}_id" => targets).select(select)
+      hdws      = Hardware.where("#{from}_id".to_sym => targets).select(select)
 
       hdws.inject(0) { |t, hdw| t + hdw.send(field).to_i }
     end