# [CRUCIBLE-SEED]
# category: sql_injection
# severity: critical
# language: ruby
# expected: ORDER BY clause built from user-supplied column name without whitelist

class ProductsController < ApplicationController
  def index
    sort_col = params[:sort_by]
    sort_dir = params[:direction]
    @products = Product.where("active = true").order("#{sort_col} #{sort_dir}")
    render json: @products
  end

  def search
    term     = params[:q]
    category = params[:category]
    @items   = Product.where("name LIKE '%#{term}%' AND category = '#{category}'")
    render json: @items
  end
end