FreakU
/
Retrospring
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix dangerous send exploit

This commit is contained in:
Yuki 2015-09-01 18:44:50 +05:30
parent 5d3d3a68e7
commit 4b891b3f70
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
app/controllers/ajax/moderation_controller.rb
View File

@ -5,7 +5,7 @@ class Ajax::ModerationController < ApplicationController
@success = false @success = false
render partial: "ajax/shared/status" render partial: "ajax/shared/status"
end end
def vote def vote
params.require :id params.require :id
params.require :upvote params.require :upvote
@ -174,7 +174,19 @@ class Ajax::ModerationController < ApplicationController
end end
@checked = status @checked = status
target_user.send("#{params[:type]}=", status) case params[:type].downcase
when 'blogger'
target_user.blogger = status
when 'contributor'
target_user.contributor = status
when 'translator'
target_user.translator = status
when 'supporter'
target_user.translator = status
when 'moderator'
target_user.translator = status
when 'admin'
target_user.translator = status
target_user.save! target_user.save!
@message = I18n.t('messages.moderation.privilege.checked', privilege: params[:type]) @message = I18n.t('messages.moderation.privilege.checked', privilege: params[:type])