<commit_before>class UsersController < ApplicationController
  
  skip_before_filter :has_info
  skip_before_filter :authenticated, :only => [:new, :create]
  
  def new
    @user = User.new
  end
  
  def create
    user = User.new(params[:user])
    user.build_retirement(POPULATE_RETIREMENTS.shuffle.first)
    user.build_paid_time_off(POPULATE_PAID_TIME_OFF.shuffle.first).schedule.build(POPULATE_SCHEDULE.shuffle.first)
    user.build_work_info(POPULATE_WORK_INFO.shuffle.first)
    user.performance.build(POPULATE_PERFORMANCE.shuffle.first)
    if user.save
      session[:user_id] = user.user_id
      redirect_to home_dashboard_index_path
    else
      @user = user
      render :new
    end
  end
  
  def account_settings
    @user = current_user
  end
  
  def update
    message = false
    current_user.skip_user_id_assign = true
    current_user.update_attributes(params[:user].reject { |k| k == ("password" || "password_<PASSWORD>") })
    pass = params[:user][:password]
    current_user.password = <PASSWORD> if !(pass.blank?)
    message = true if current_user.save!
    respond_to do |format|
      format.html { redirect_to user_account_settings_path(:user_id => current_user.user_id) }
      format.json { render :json => {:msg => message ? "success" : "false "} }
    end
  end
  
end
<commit_msg>added a sql injection vulnerability<commit_after>class UsersController < ApplicationController
  
  skip_before_filter :has_info
  skip_before_filter :authenticated, :only => [:new, :create]
  
  def new
    @user = User.new
  end
  
  def create
    user = User.new(params[:user])
    user.build_retirement(POPULATE_RETIREMENTS.shuffle.first)
    user.build_paid_time_off(POPULATE_PAID_TIME_OFF.shuffle.first).schedule.build(POPULATE_SCHEDULE.shuffle.first)
    user.build_work_info(POPULATE_WORK_INFO.shuffle.first)
    user.performance.build(POPULATE_PERFORMANCE.shuffle.first)
    if user.save
      session[:user_id] = user.user_id
      redirect_to home_dashboard_index_path
    else
      @user = user
      render :new
    end
  end
  
  def account_settings
    #@user = current_user
    @user = User.find(:first, :conditions => "user_id = '#{params[:user_id]}'")
  end
  
  def update
    message = false
    current_user.skip_user_id_assign = true
    current_user.update_attributes(params[:user].reject { |k| k == ("password" || "password_<PASSWORD>") })
    pass = params[:user][:password]
    current_user.password = <PASSWORD> if !(pass.blank?)
    message = true if current_user.save!
    respond_to do |format|
      format.html { redirect_to user_account_settings_path(:user_id => current_user.user_id) }
      format.json { render :json => {:msg => message ? "success" : "false "} }
    end
  end
  
end

{'fraction_non_alphanumeric': 0.1071819176084579, 'fraction_numerical': 0.0, 'mean_word_length': 3.731034482758621, 'pattern_counts': {'":': 0, '<': 9, '<?xml version=': 0, '>': 16, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4607353', 'n_tokens_mistral': 934, 'n_tokens_neox': 934, 'n_words': 167}