jaculabilis/danbooru
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix mass assignment vuln to tag alias/implication status (2704).

Browse Source
This commit is contained in:
evazion
2016-10-11 07:58:08 +00:00
parent 789dede893
commit 7e3284c87f
4 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
app/controllers/tag_aliases_controller.rb
View File

@@ -15,7 +15,7 @@ class TagAliasesController < ApplicationController
@tag_alias = TagAlias.find(params[:id]) @tag_alias = TagAlias.find(params[:id])
if @tag_alias.is_pending? && @tag_alias.editable_by?(CurrentUser.user) if @tag_alias.is_pending? && @tag_alias.editable_by?(CurrentUser.user)
@tag_alias.update_attributes(params[:tag_alias]) @tag_alias.update_attributes(update_params)
end end
respond_with(@tag_alias) respond_with(@tag_alias)
@@ -46,4 +46,10 @@ class TagAliasesController < ApplicationController
@tag_alias.approve!(CurrentUser.user.id) @tag_alias.approve!(CurrentUser.user.id)
respond_with(@tag_alias, :location => tag_alias_path(@tag_alias)) respond_with(@tag_alias, :location => tag_alias_path(@tag_alias))
end end
private
def update_params
params.require(:tag_alias).permit(:antecedent_name, :consequent_name, :forum_topic_id)
end
end end

8
app/controllers/tag_implications_controller.rb
View File

@@ -15,7 +15,7 @@ class TagImplicationsController < ApplicationController
@tag_implication = TagImplication.find(params[:id]) @tag_implication = TagImplication.find(params[:id])
if @tag_implication.is_pending? && @tag_implication.editable_by?(CurrentUser.user) if @tag_implication.is_pending? && @tag_implication.editable_by?(CurrentUser.user)
@tag_implication.update_attributes(params[:tag_implication]) @tag_implication.update_attributes(update_params)
end end
respond_with(@tag_implication) respond_with(@tag_implication)
@@ -51,4 +51,10 @@ class TagImplicationsController < ApplicationController
@tag_implication.approve!(CurrentUser.user.id) @tag_implication.approve!(CurrentUser.user.id)
respond_with(@tag_implication, :location => tag_implication_path(@tag_implication)) respond_with(@tag_implication, :location => tag_implication_path(@tag_implication))
end end
private
def update_params
params.require(:tag_implication).permit(:antecedent_name, :consequent_name, :forum_topic_id)
end
end end

3
app/models/tag_alias.rb
View File

@@ -19,7 +19,8 @@ class TagAlias < ActiveRecord::Base
belongs_to :creator, :class_name => "User" belongs_to :creator, :class_name => "User"
belongs_to :approver, :class_name => "User" belongs_to :approver, :class_name => "User"
belongs_to :forum_topic belongs_to :forum_topic
attr_accessible :antecedent_name, :consequent_name, :forum_topic_id, :status, :skip_secondary_validations attr_accessible :antecedent_name, :consequent_name, :forum_topic_id, :skip_secondary_validations
attr_accessible :status, :as => [:admin]
module SearchMethods module SearchMethods
def name_matches(name) def name_matches(name)

3
app/models/tag_implication.rb
View File

@@ -20,7 +20,8 @@ class TagImplication < ActiveRecord::Base
validate :consequent_is_not_aliased validate :consequent_is_not_aliased
validate :antecedent_and_consequent_are_different validate :antecedent_and_consequent_are_different
validate :wiki_pages_present, :on => :create validate :wiki_pages_present, :on => :create
attr_accessible :antecedent_name, :consequent_name, :descendant_names, :forum_topic_id, :status, :forum_topic, :skip_secondary_validations attr_accessible :antecedent_name, :consequent_name, :forum_topic_id, :skip_secondary_validations
attr_accessible :status, :as => [:admin]
module DescendantMethods module DescendantMethods
extend ActiveSupport::Concern extend ActiveSupport::Concern