jaculabilis/danbooru
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

posts: fix IP leak in /posts.json includes.

Browse Source 
This leaks the full post object in the error message, which includes the
uploader's IP:

* https://danbooru.donmai.us/posts/4871548.json?only=updater
This commit is contained in:
evazion
2021-10-27 02:36:24 -05:00
parent e697d1886d
commit a607cb1cb1
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/models/post.rb
View File

@@ -1359,7 +1359,7 @@ class Post < ApplicationRecord
def self.available_includes def self.available_includes
# attributes accessible through the ?only= parameter # attributes accessible through the ?only= parameter
%i[ %i[
uploader updater approver upload flags appeals parent children notes uploader approver upload flags appeals parent children notes
comments approvals disapprovals replacements pixiv_ugoira_frame_data comments approvals disapprovals replacements pixiv_ugoira_frame_data
artist_commentary artist_commentary
] ]