restrict search filters to description, species

app/models/item.rb

@@ -66,9 +66,11 @@ class Item < ActiveRecord::Base
           "%,#{species.id},%",
           "%,#{species.id}"
         ))
-      else
-        column = @property ? @property : :name
+      elsif @property == 'description' || @property.blank?
+        column = @property == 'description' ? :description : :name
         condition = items[column].matches("%#{self}%")
+      else
+        raise ArgumentError, "Unknown search filter \"#{@property}\""
       end
       condition = condition.not if @negative
       scope.where(condition)

spec/models/item_spec.rb

@@ -164,5 +164,9 @@ describe Item do
     specify "should raise exception for a query that's too short" do
       lambda { Item.search('e').all }.should raise_error(ArgumentError)
     end
+    
+    specify "should not be able to search other attributes thru filters" do
+      lambda { Item.search('id:1').all }.should raise_error(ArgumentError)
+    end
   end
 end