Security fix. Prevent unauthorized deletion.

Legacy anonymous screenshot uploads could have been deleted by anonymous
users.
This commit is contained in:
Christoph Haas 2021-03-21 16:24:35 +01:00
parent 1d53e0e9b6
commit a51e712925

View file

@ -96,7 +96,7 @@ class PackagesController < ApplicationController
new_screenshot.simage_derivatives!
new_screenshot.save!
auditlog "Screenshot uploaded successfully.",
auditlog "Screenshot #{new_screenshot.id} uploaded successfully.",
screenshot: new_screenshot, package: @package
@valid_images.push new_screenshot
@ -216,7 +216,7 @@ class PackagesController < ApplicationController
# Check if the user is allowed to change this screenshot
# - Is this the user's own screenshot? (anonymous)
if (@screenshot.user == current_user) || (can? :destroy, @screenshot)
if can? :destroy, @screenshot
auditlog "Screenshot #{@screenshot.id} deleted",
package: @screenshot.package
@screenshot.destroy