chaas/debshots
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

Security fix. Prevent unauthorized deletion.

Browse source 
Legacy anonymous screenshot uploads could have been deleted by anonymous
users.
This commit is contained in:
Christoph Haas 2021-03-21 16:24:35 +01:00
parent 1d53e0e9b6
commit a51e712925
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
app/controllers/packages_controller.rb
View file

@ -96,7 +96,7 @@ class PackagesController < ApplicationController
new_screenshot.simage_derivatives! new_screenshot.simage_derivatives!
new_screenshot.save! new_screenshot.save!
auditlog "Screenshot uploaded successfully.", auditlog "Screenshot #{new_screenshot.id} uploaded successfully.",
screenshot: new_screenshot, package: @package screenshot: new_screenshot, package: @package
@valid_images.push new_screenshot @valid_images.push new_screenshot
@ -216,7 +216,7 @@ class PackagesController < ApplicationController
# Check if the user is allowed to change this screenshot # Check if the user is allowed to change this screenshot
# - Is this the user's own screenshot? (anonymous) # - Is this the user's own screenshot? (anonymous)
if (@screenshot.user == current_user) || (can? :destroy, @screenshot) if can? :destroy, @screenshot
auditlog "Screenshot #{@screenshot.id} deleted", auditlog "Screenshot #{@screenshot.id} deleted",
package: @screenshot.package package: @screenshot.package
@screenshot.destroy @screenshot.destroy