From ba8f7e5cf37e877ce5ed49cd4e58f848dcbc41be Mon Sep 17 00:00:00 2001 From: Henne Vogelsang Date: Tue, 26 Mar 2024 16:20:12 +0100 Subject: [PATCH] Allow to serialize TimeZone classes --- config/application.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/application.rb b/config/application.rb index 1953c529..fc72c02c 100644 --- a/config/application.rb +++ b/config/application.rb @@ -36,6 +36,6 @@ module Osem # This is a nightmare with our current data model, no one ever thought about this. config.active_record.belongs_to_required_by_default = false # https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017 - config.active_record.yaml_column_permitted_classes = ['Date', 'DateTime', 'Symbol', 'Time'] + config.active_record.yaml_column_permitted_classes = ['Date', 'DateTime', 'Symbol', 'Time', 'ActiveSupport::TimeWithZone', 'ActiveSupport::TimeZone'] end end