Fix external user statistics for tags

app/controllers/external_users_controller.rb

@@ -43,15 +43,15 @@ class ExternalUsersController < ApplicationController
                  (created_at - lag(created_at) over (PARTITION BY user_id, exercise_id
                                                      ORDER BY created_at)) AS working_time
           FROM submissions
-          WHERE user_id = #{@user.id}
+          WHERE #{ExternalUser.sanitize_sql(['user_id = ?', @user.id])}
             AND user_type = 'ExternalUser'
-          #{current_user.admin? ? '' : "AND study_group_id IN (#{current_user.study_groups.pluck(:id).join(', ')}) AND cause = 'submit'"}
+          #{current_user.admin? ? '' : "AND #{ExternalUser.sanitize_sql(['study_group_id IN (?)', current_user.study_groups.pluck(:id).join(', ')])}) AND cause = 'submit'"}
           GROUP BY exercise_id,
                    user_id,
                    id
           ) AS foo
       ) AS bar
-    #{tag.nil? ? '' : " JOIN exercise_tags et ON et.exercise_id = bar.exercise_id AND et.tag_id = #{tag} "}
+    #{tag.nil? ? '' : " JOIN exercise_tags et ON et.exercise_id = bar.exercise_id AND #{ExternalUser.sanitize_sql(['et.tag_id = ?', tag])}"}
     GROUP BY user_id,
              bar.exercise_id;
     "
@@ -60,10 +60,14 @@ class ExternalUsersController < ApplicationController
   def statistics
     @user = ExternalUser.find(params[:id])
     authorize!
+    if params[:tag].present?
+      tag = Tag.find(params[:tag])
+      authorize(tag, :show?)
+    end
 
     statistics = {}
 
-    ApplicationRecord.connection.execute(working_time_query(params[:tag])).each do |tuple|
+    ApplicationRecord.connection.execute(working_time_query(tag&.id)).each do |tuple|
       statistics[tuple['exercise_id'].to_i] = tuple
     end