Security fix. Prevent unauthorized deletion.
Legacy anonymous screenshot uploads could have been deleted by anonymous users.
This commit is contained in:
parent
1d53e0e9b6
commit
a51e712925
1 changed files with 2 additions and 2 deletions
|
|
@ -96,7 +96,7 @@ class PackagesController < ApplicationController
|
|||
new_screenshot.simage_derivatives!
|
||||
|
||||
new_screenshot.save!
|
||||
auditlog "Screenshot uploaded successfully.",
|
||||
auditlog "Screenshot #{new_screenshot.id} uploaded successfully.",
|
||||
screenshot: new_screenshot, package: @package
|
||||
|
||||
@valid_images.push new_screenshot
|
||||
|
|
@ -216,7 +216,7 @@ class PackagesController < ApplicationController
|
|||
|
||||
# Check if the user is allowed to change this screenshot
|
||||
# - Is this the user's own screenshot? (anonymous)
|
||||
if (@screenshot.user == current_user) || (can? :destroy, @screenshot)
|
||||
if can? :destroy, @screenshot
|
||||
auditlog "Screenshot #{@screenshot.id} deleted",
|
||||
package: @screenshot.package
|
||||
@screenshot.destroy
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue