# Security Flaw With acts\_as\_xapian

**URL:** <https://www.ruby-forum.com/t/security-flaw-with-acts-as-xapian/169363>\
**Category:** Rails\
**Created:** [June 2, 2009, 9:16pm UTC](https://www.ruby-forum.com/t/security-flaw-with-acts-as-xapian/169363 "2009-06-02T21:16:33Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![PeteSalty](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bc79bd/32.png) [@PeteSalty](https://www.ruby-forum.com/u/PeteSalty)\
**Post date:** [June 2, 2009, 9:16pm UTC](https://www.ruby-forum.com/t/security-flaw-with-acts-as-xapian/169363/1 "2009-06-02T21:16:33Z")

</div>

I’ve found a secuirty issue with the proxy implementation of  
find\_with\_xapian in the acts\_as\_xapian plugin. I’ve documented it over  
at the acts\_as\_xapian Google Group ([http://groups.google.com/group/](http://groups.google.com/group/)  
acts\_as\_xapian/browse\_thread/thread/8bc8da3275985383) but since that  
group is pretty low traffic I thought it would be a good idea to let  
people know about it here too just in case they’re using aax but don’t  
know about it yet.

Dale