Fix remote code execution exploit

app/controllers/ajax/report_controller.rb

@@ -23,10 +23,19 @@ class Ajax::ReportController < ApplicationController
       return
     end
 
-    object = if params[:type] == 'user'
+    obj = params[:type].strip.capitalize
+
+    object = case params[:type].strip.capitalize
+      when 'User'
         User.find_by_screen_name params[:id]
+      when 'Question'
+        Question
+      when 'Answer'
+        Answer
+      when 'Comment'
+        Comment
       else
-               params[:type].strip.capitalize.constantize.find params[:id]
+        Answer
       end
 
     if object.nil?