From a51e7129259c17f8c3bab870df20e106b0723eec Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Sun, 21 Mar 2021 16:24:35 +0100 Subject: [PATCH] Security fix. Prevent unauthorized deletion. Legacy anonymous screenshot uploads could have been deleted by anonymous users. --- app/controllers/packages_controller.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/app/controllers/packages_controller.rb b/app/controllers/packages_controller.rb index dac2927..4e9c95f 100644 --- a/app/controllers/packages_controller.rb +++ b/app/controllers/packages_controller.rb @@ -96,7 +96,7 @@ class PackagesController < ApplicationController new_screenshot.simage_derivatives! new_screenshot.save! - auditlog "Screenshot uploaded successfully.", + auditlog "Screenshot #{new_screenshot.id} uploaded successfully.", screenshot: new_screenshot, package: @package @valid_images.push new_screenshot @@ -216,7 +216,7 @@ class PackagesController < ApplicationController # Check if the user is allowed to change this screenshot # - Is this the user's own screenshot? (anonymous) - if (@screenshot.user == current_user) || (can? :destroy, @screenshot) + if can? :destroy, @screenshot auditlog "Screenshot #{@screenshot.id} deleted", package: @screenshot.package @screenshot.destroy