@scarroll32 Ok with releasing this as Ransack 4.0?

I will prepare a release tomorrow.

@scarroll32 I created a release draft. It's been a while without releases, so let me know how it looks if you have some time! Otherwise I'll just release this tommorrow™️.

References

• https://positive.security/blog/ransack-data-exfiltration
• https://portswigger.net/daily-swig/ruby-on-rails-apps-vulnerable-to-data-theft-through-ransack-search

I really understood the security idea about this change.

But when something doesn't have a door the path is "free".
When you put a door on the path and force every player to implement a key to use this door, everything is okay when this door is just for 2 people.

However, when all of the world need to use this door, you generate a big problem! Imagine, need to generate a key for everyone.

So, this behavior break so many applications that discourages people use ransack. Because the core changed and break the whole app, forced to implement this security feature.