Fix insecure params error and Add sort_url function.

README.md

@@ -221,6 +221,23 @@ Ransack.configure do |c|
 end
 ```
 
+####`sort_url` is return only url of `sort_link`
+
+It can be used like `sort_link`.
+
+```erb
+<%= sort_url(@q, :name, default_order: :desc) %>
+```
+
+```erb
+<%= sort_url(@q, :last_name, [:last_name, 'first_name asc']) %>
+```
+
+```erb
+<%= sort_url(@q, :last_name, %i(last_name first_name),
+  default_order: { last_name: 'asc', first_name: 'desc' }) %>
+```
+
 ### Advanced Mode
 
 "Advanced" searches (ab)use Rails' nested attributes functionality in order to

lib/ransack/helpers/form_helper.rb

@@ -46,14 +46,22 @@ def search_form_for(record, options = {}, &proc)
       #
       def sort_link(search_object, attribute, *args, &block)
         search, routing_proxy = extract_search_and_routing_proxy(search_object)
-        unless Search === search
-          raise TypeError, 'First argument must be a Ransack::Search!'
-        end
+        raise TypeError, 'First argument must be a Ransack::Search!' unless Search === search
         args.unshift(capture(&block)) if block_given?
-        s = SortLink.new(search, attribute, args, params, &block)
+        s = SortLink.new(search, attribute, args, search_params(search), &block)
         link_to(s.name, url(routing_proxy, s.url_options), s.html_options(args))
       end
 
+      # +sort_url+
+      # <%= sort_url(@q, :created_at, default_order: :desc) %>
+      #
+      def sort_url(search_object, attribute, *args)
+        search, routing_proxy = extract_search_and_routing_proxy(search_object)
+        raise TypeError, 'First argument must be a Ransack::Search!' unless Search === search
+        s = SortLink.new(search, attribute, args, search_params(search))
+        url(routing_proxy, s.url_options)
+      end
+
       private
 
         def options_for(record)
@@ -75,6 +83,14 @@ def extract_search_and_routing_proxy(search)
           [search, nil]
         end
 
+        def search_params(search)
+          begin
+            params.permit.tap {|whitelisted| whitelisted[search.context.search_key] = params[search.context.search_key] }
+          rescue
+            params
+          end
+        end
+
         def url(routing_proxy, options_for_url)
           if routing_proxy && respond_to?(routing_proxy)
             send(routing_proxy).url_for(options_for_url)