modreports: fix private user information leak in new modreport action.
Fix this:
https://danbooru.donmai.us/moderation_reports/new.json?moderation_report[model_id]=52664&moderation_report[model_type]=User
raising an `undefined method `reportable?' for #<UserPolicy ...>`
exception, which contained the full user object in the error message,
which leaked private user information.
This commit is contained in:
@@ -10,7 +10,7 @@ class ModerationReportPolicy < ApplicationPolicy
|
||||
end
|
||||
|
||||
def create?
|
||||
unbanned? && policy(record.model).reportable?
|
||||
unbanned? && policy(record.model).try(:reportable?)
|
||||
end
|
||||
|
||||
def update?
|
||||
|
||||
Reference in New Issue
Block a user