From 49d18e64e8e242449f09f89338586c6c3cbe9a8b Mon Sep 17 00:00:00 2001
From: evazion <noizave@gmail.com>
Date: Mon, 30 Aug 2021 16:44:40 -0500
Subject: [PATCH] Fix #4869: "Random" button raises exception when viewing
 ordfav.

Fix exception during https://danbooru.donmai.us/posts/random?tags=ordfav:nonamethanks

Before we were doing a query like this:

    SELECT
      "posts".*
    FROM
      "posts"
    INNER JOIN
      "favorites" ON "favorites"."post_id" = "posts"."id"
    WHERE
      (favorites.user_id % 100 = 64 AND favorites.user_id = 52664)
      AND "posts"."id" = 343894
    ORDER BY
      favorites.id DESC,
      posts.id DESC,
      ID=343894 DESC

but `ID=? DESC` is ambiguous during an ordfav: search because of the
join on the favorites table. The fix is to qualify the reference as
`posts.id`.
---
 app/logical/concerns/searchable.rb       | 2 +-
 test/functional/posts_controller_test.rb | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/app/logical/concerns/searchable.rb b/app/logical/concerns/searchable.rb
index 7f5a3c5c6..02df65732 100644
--- a/app/logical/concerns/searchable.rb
+++ b/app/logical/concerns/searchable.rb
@@ -505,7 +505,7 @@ module Searchable
   def find_ordered(ids)
     order_clause = []
     ids.each do |id|
-      order_clause << sanitize_sql_array(["ID=? DESC", id])
+      order_clause << sanitize_sql_array(["#{qualified_column_for(:id)} = ? DESC", id])
     end
     where(id: ids).order(Arel.sql(order_clause.join(', ')))
   end
diff --git a/test/functional/posts_controller_test.rb b/test/functional/posts_controller_test.rb
index aa2f7face..295dbd8d0 100644
--- a/test/functional/posts_controller_test.rb
+++ b/test/functional/posts_controller_test.rb
@@ -492,6 +492,13 @@ class PostsControllerTest < ActionDispatch::IntegrationTest
         assert_redirected_to(post_path(@post, tags: "aaaa"))
       end
 
+      should "render for a ordfav: search" do
+        @post = as(@user) { create(:post, tag_string: "fav:me") }
+        get random_posts_path, params: { tags: "ordfav:#{@user.name}" }
+
+        assert_redirected_to(post_path(@post, tags: "ordfav:#{@user.name}"))
+      end
+
       should "return a 404 when no random posts can be found" do
         get random_posts_path, params: { tags: "qoigjegoi" }
         assert_response 404