Fix _discard leaking into SQL for multi-select enum filters

When an enum filter is used in multi-select mode, _discard gets
submitted as a literal value on subsequent page loads, producing
invalid SQL like: WHERE (col IN ('_discard','val1','val2'))

Client-side: deselect _discard option when initializing multi-select.
Server-side: strip _discard from array values as defense-in-depth.

Author: tonekk

lib/rails_admin/abstract_model.rb

@@ -140,7 +140,13 @@ def initialize(column, type, value, operator)
       end
 
       def to_statement
-        return if [@operator, @value].any? { |v| v == '_discard' }
+        return if @operator == '_discard'
+        return if @value == '_discard'
+
+        if @value.is_a?(Array) && @value.include?('_discard')
+          @value = @value.reject { |v| v == '_discard' }
+          return if @value.empty?
+        end
 
         unary_operators[@operator] || unary_operators[@value] ||
           build_statement_for_type_generic

spec/controllers/rails_admin/main_controller_spec.rb

@@ -472,7 +472,7 @@ def get(action, params)
           'delete_paperclip_asset' => 'test',
           'should_not_be_here' => 'test',
         }.merge(defined?(ActiveStorage) ? {'active_storage_asset' => 'test', 'remove_active_storage_asset' => 'test', 'active_storage_assets' => 'test', 'remove_active_storage_assets' => 'test'} : {}).
-          merge(defined?(Shrine) ? {'shrine_asset' => 'test', 'remove_shrine_asset' => 'test'} : {}),
+         merge(defined?(Shrine) ? {'shrine_asset' => 'test', 'remove_shrine_asset' => 'test'} : {}),
       )
 
       controller.send(:sanitize_params_for!, :create, RailsAdmin.config(FieldTest), controller.params['field_test'])

spec/rails_admin/adapters/active_record_spec.rb

@@ -305,6 +305,11 @@ def build_statement(type, value, operator)
       end
     end
 
+    it "strips '_discard' from array values" do
+      expect(build_statement(:enum, ['_discard'], nil)).to be_nil
+      expect(build_statement(:enum, %w[_discard foo bar], nil)).to eq(['(field IN (?))', %w[foo bar]])
+    end
+
     describe 'string type queries' do
       it 'supports string type query' do
         expect(build_statement(:string, '', nil)).to be_nil

spec/rails_admin/adapters/mongoid_spec.rb

@@ -277,6 +277,11 @@ def parse_value(value)
       end
     end
 
+    it "strips '_discard' from array values" do
+      expect(@abstract_model.send(:build_statement, :name, :enum, ['_discard'], nil)).to be_nil
+      expect(@abstract_model.send(:build_statement, :name, :enum, %w[_discard foo bar], nil)).to eq(name: {'$in' => %w[foo bar]})
+    end
+
     it "supports '_blank' operator" do
       [['_blank', ''], ['', '_blank']].each do |value, operator|
         expect(@abstract_model.send(:build_statement, :name, :string, value, operator)).to eq(name: {'$in' => [nil, '']})

src/rails_admin/filter-box.js

@@ -102,7 +102,10 @@ import flatpickr from "flatpickr";
                 $(this).attr("selected", true);
             });
             if (multiple)
-              control.find("option[value^=_],option[disabled]").hide();
+              control
+                .find("option[value^=_],option[disabled]")
+                .hide()
+                .prop("selected", false);
           }
           break;
         case "citext":