midgard/tab
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix IDOR in requests

Browse source
This commit is contained in:
redfast00 2019-03-24 22:31:03 +01:00
parent 43580c3545
commit b44e288070
No known key found for this signature in database
GPG key ID: 5946E0E34FD0553C
3 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/controllers/notifications_controller.rb
View file

@ -1,5 +1,5 @@
class NotificationsController < ApplicationController class NotificationsController < ApplicationController
load_and_authorize_resource :user, only: :index, find_by: :name load_and_authorize_resource :user, find_by: :name
before_action :load_notification, only: :read before_action :load_notification, only: :read
authorize_resource :notification, only: :read authorize_resource :notification, only: :read

2
app/controllers/requests_controller.rb
View file

@ -1,5 +1,5 @@
class RequestsController < ApplicationController class RequestsController < ApplicationController
load_and_authorize_resource :user, only: :index, find_by: :name load_and_authorize_resource :user, find_by: :name
before_action :load_request, only: [:confirm, :decline] before_action :load_request, only: [:confirm, :decline]
authorize_resource :request, only: [:confirm, :decline] authorize_resource :request, only: [:confirm, :decline]

5
app/models/user_ability.rb
View file

@ -5,8 +5,9 @@ class UserAbility
return unless user return unless user
can :manage, :all if user.penning? can :manage, :all if user.penning?
can :manage, user, id: user.id can :create, Request, creditor_id: user.id
can :manage, Request, creditor_id: user.id can [:confirm, :decline], Request, debtor_id: user.id
can :read, User, id: user.id
can :manage, Notification, user_id: user.id can :manage, Notification, user_id: user.id
can :create, Transaction do |t| can :create, Transaction do |t|
t.debtor == user && t.amount <= Rails.application.config.maximum_amount t.debtor == user && t.amount <= Rails.application.config.maximum_amount