Security fix: users must not approve their own uploads

This commit is contained in:
Christoph Haas 2021-02-18 02:00:11 +01:00
parent 2dedd924ee
commit 3116fb6b4d

View file

@ -167,10 +167,14 @@ class PackagesController < ApplicationController
end
def approve_screenshot
@screenshot = Screenshot.find(params[:id])
@screenshot.approve!
flash['notice'] = "Screenshot approved."
redirect_back(fallback_location: package_path(name: @screenshot.package.name))
if current_user && current_user.is_admin?
@screenshot = Screenshot.find(params[:id])
@screenshot.approve!
flash['notice'] = "Screenshot approved."
redirect_back(fallback_location: package_path(name: @screenshot.package.name))
else
head :forbidden
end
end
# Returns a 160x120 thumbnail image if posssible.