Security fix: users must not approve their own uploads
This commit is contained in:
parent
2dedd924ee
commit
3116fb6b4d
1 changed files with 8 additions and 4 deletions
|
|
@ -167,10 +167,14 @@ class PackagesController < ApplicationController
|
|||
end
|
||||
|
||||
def approve_screenshot
|
||||
@screenshot = Screenshot.find(params[:id])
|
||||
@screenshot.approve!
|
||||
flash['notice'] = "Screenshot approved."
|
||||
redirect_back(fallback_location: package_path(name: @screenshot.package.name))
|
||||
if current_user && current_user.is_admin?
|
||||
@screenshot = Screenshot.find(params[:id])
|
||||
@screenshot.approve!
|
||||
flash['notice'] = "Screenshot approved."
|
||||
redirect_back(fallback_location: package_path(name: @screenshot.package.name))
|
||||
else
|
||||
head :forbidden
|
||||
end
|
||||
end
|
||||
|
||||
# Returns a 160x120 thumbnail image if posssible.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue