#434

backend/app/services/counts_query.rb

@@ -20,6 +20,7 @@ class CountsQuery
     @id_column = resource == 'posts' ? 'post_id' : 'tag_id'
     @params = params
     @latest_expression = latest_expression
+    scope = HistoryAccess.visible(scope)
     @scope = scope.except(:select, :order).joins(
         "LEFT JOIN users counts_actor ON counts_actor.id = #{ @table }.created_by_user_id")
     raise ArgumentError unless (params.keys - KEYS).empty?
@@ -33,7 +34,7 @@ class CountsQuery
     @limit = integer('limit', 20)
     raise ArgumentError if limit > 100 || page > 1_000_000
 
-    columns = params.fetch('columns', COLUMNS.fetch(resource).join(',')).split(',')
+    columns = QueryState.list(params.fetch('columns', COLUMNS.fetch(resource).join(' ')))
     if columns.empty? || columns.uniq != columns || (columns - COLUMNS.fetch(resource)).any?
       raise ArgumentError
     end
@@ -92,7 +93,7 @@ class CountsQuery
     value = @params.fetch('sort', mode == 'details' ? 'created_at:desc' : 'group:asc')
     return [] if value.empty?
 
-    values = value.split(',', -1).map { _1.split(':', -1) }
+    values = QueryState.list(value).map { _1.split(':', -1) }
     allowed = mode == 'details' ? COLUMNS.fetch(@resource) - ['thumbnail'] : ['group', 'count']
     invalid = values.any? do |key, direction, *extra|
       extra.any? || !allowed.include?(key) || !['asc', 'desc'].include?(direction)