github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-12-16 02:28:33 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: correctly validate input when admin searches for screened ips

Browse Source
This commit is contained in:
Sam 2017-02-06 16:10:48 -05:00
parent 5fc70471be
commit 1d3f04d4bb
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/admin/screened_ip_addresses_controller.rb
View File

@ -9,7 +9,7 @@ class Admin::ScreenedIpAddressesController < Admin::AdminController
filter = IPAddr.handle_wildcards(filter)
screened_ip_addresses = ScreenedIpAddress
screened_ip_addresses = screened_ip_addresses.where("cidr '#{filter}' >>= ip_address") if filter.present?
screened_ip_addresses = screened_ip_addresses.where("cidr :filter >>= ip_address", filter: filter) if filter.present?
screened_ip_addresses = screened_ip_addresses.limit(200).order('match_count desc')
begin

7
spec/controllers/admin/screened_ip_addresses_controller_spec.rb
View File

@ -16,10 +16,15 @@ describe Admin::ScreenedIpAddressesController do
Fabricate(:screened_ip_address, ip_address: "1.2.3.6")
Fabricate(:screened_ip_address, ip_address: "4.5.6.7")
xhr :get, :index, filter: "4.*"
xhr :get, :index, filter: "1.2.*"
expect(response).to be_success
result = JSON.parse(response.body)
expect(result.length).to eq(3)
xhr :get, :index, filter: "4.5.6.7"
expect(response).to be_success
result = JSON.parse(response.body)
expect(result.length).to eq(1)
end