FreakU
/
Retrospring
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix remote code execution exploit

This commit is contained in:
Yuki 2015-09-01 18:44:31 +05:30
parent 419b578956
commit 5d3d3a68e7
1 changed files with 15 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
app/controllers/ajax/report_controller.rb
View File

@ -5,7 +5,7 @@ class Ajax::ReportController < ApplicationController
@success = false @success = false
render partial: "ajax/shared/status" render partial: "ajax/shared/status"
end end
def create def create
params.require :id params.require :id
params.require :type params.require :type
@ -23,11 +23,20 @@ class Ajax::ReportController < ApplicationController
return return
end end
object = if params[:type] == 'user' obj = params[:type].strip.capitalize
User.find_by_screen_name params[:id]
else object = case params[:type].strip.capitalize
params[:type].strip.capitalize.constantize.find params[:id] when 'User'
end User.find_by_screen_name params[:id]
when 'Question'
Question
when 'Answer'
Answer
when 'Comment'
Comment
else
Answer
end
if object.nil? if object.nil?
@message = I18n.t('messages.report.create.not_found', parameter: params[:type]) @message = I18n.t('messages.report.create.not_found', parameter: params[:type])