chaas/debshots
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

Security fix: users must not approve their own uploads

Browse source
This commit is contained in:
Christoph Haas 2021-02-18 02:00:11 +01:00
parent 2dedd924ee
commit 3116fb6b4d
1 changed files with 8 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

12
app/controllers/packages_controller.rb
View file

@ -167,10 +167,14 @@ class PackagesController < ApplicationController
end end
def approve_screenshot def approve_screenshot
@screenshot = Screenshot.find(params[:id]) if current_user && current_user.is_admin?
@screenshot.approve! @screenshot = Screenshot.find(params[:id])
flash['notice'] = "Screenshot approved." @screenshot.approve!
redirect_back(fallback_location: package_path(name: @screenshot.package.name)) flash['notice'] = "Screenshot approved."
redirect_back(fallback_location: package_path(name: @screenshot.package.name))
else
head :forbidden
end
end end
# Returns a 160x120 thumbnail image if posssible. # Returns a 160x120 thumbnail image if posssible.