b695c4ccb1
Fix this:
https://danbooru.donmai.us/moderation_reports/new.json?moderation_report[model_id]=52664&moderation_report[model_type]=User
raising an `undefined method `reportable?' for #<UserPolicy ...>`
exception, which contained the full user object in the error message,
which leaked private user information.
32 lines
497 B
Ruby
32 lines
497 B
Ruby
# frozen_string_literal: true
|
|
|
|
class ModerationReportPolicy < ApplicationPolicy
|
|
def index?
|
|
!user.is_anonymous?
|
|
end
|
|
|
|
def show?
|
|
!user.is_anonymous?
|
|
end
|
|
|
|
def create?
|
|
unbanned? && policy(record.model).try(:reportable?)
|
|
end
|
|
|
|
def update?
|
|
user.is_moderator?
|
|
end
|
|
|
|
def can_see_moderation_reports?
|
|
user.is_moderator?
|
|
end
|
|
|
|
def permitted_attributes_for_create
|
|
[:model_type, :model_id, :reason]
|
|
end
|
|
|
|
def permitted_attributes_for_update
|
|
[:status]
|
|
end
|
|
end
|