Skip to content

Fix _discard leaking into SQL for multi-select enum filters#3738

Open
tonekk wants to merge 1 commit into
railsadminteam:masterfrom
tonekk:fix/discard-leaks-into-sql-for-multiselect-enum-filters
Open

Fix _discard leaking into SQL for multi-select enum filters#3738
tonekk wants to merge 1 commit into
railsadminteam:masterfrom
tonekk:fix/discard-leaks-into-sql-for-multiselect-enum-filters

Conversation

@tonekk

@tonekk tonekk commented Apr 11, 2026

Copy link
Copy Markdown

Summary

When an enum filter is used in multi-select mode, _discard (the "..." placeholder) gets submitted as a literal value on subsequent page loads, producing SQL like:

WHERE (users.role IN ('_discard','admin','editor'))

This PR fixes both the client-side and server-side causes.

Steps to reproduce

  1. Have a model with an enum field (e.g. role on User)
  2. Navigate to the index page and open the filter for that enum field
  3. Select multiple values (e.g. admin and editor) and submit the filter
  4. On the filtered results page, do not touch the filter select — just click "Filter" (submit) again
  5. Observe the generated SQL: _discard appears as a value in the IN (...) clause

Root cause

Client-side (src/rails_admin/filter-box.js): When restoring a multi-select filter on page reload, _discard remains implicitly selected because .prop("multiple", true) preserves the default selection, and the code only hides the option without deselecting it.

Server-side (lib/rails_admin/abstract_model.rb): The _discard guard only checks scalar equality (v == '_discard'), which is always false when @value is an array like ['_discard', 'admin', 'editor'].

Fix

  • Client-side: Add .prop("selected", false) when hiding special options in multi-select mode
  • Server-side: Strip _discard from array values as defense-in-depth; return nil if the array becomes empty after stripping

@tonekk tonekk changed the title Fix _discard leaking into SQL for multi-select enum filters Fix _discard leaking into SQL for multi-select enum filters Apr 11, 2026
@tonekk
tonekk force-pushed the fix/discard-leaks-into-sql-for-multiselect-enum-filters branch 5 times, most recently from 9d5771f to 49f3392 Compare April 11, 2026 13:46
When an enum filter is used in multi-select mode, _discard gets
submitted as a literal value on subsequent page loads, producing
invalid SQL like: WHERE (col IN ('_discard','val1','val2'))

Client-side: deselect _discard option when initializing multi-select.
Server-side: strip _discard from array values as defense-in-depth.
@tonekk
tonekk force-pushed the fix/discard-leaks-into-sql-for-multiselect-enum-filters branch from 49f3392 to 721bce4 Compare April 11, 2026 14:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant