github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-12-15 16:23:50 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: restrict constantize classes in search controller

Browse Source
This commit is contained in:
Sam 2016-06-17 13:46:59 +10:00
parent 1e241dedad
commit 2b81c593f5
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
app/controllers/search_controller.rb
View File

@ -81,9 +81,10 @@ class SearchController < ApplicationController
context_obj = nil context_obj = nil
if ['user','private_messages'].include? search_context[:type] if ['user','private_messages'].include? search_context[:type]
context_obj = User.find_by(username_lower: search_context[:id].downcase) context_obj = User.find_by(username_lower: search_context[:id].downcase)
else elsif 'category' == search_context[:type]
klass = search_context[:type].classify.constantize context_obj = Category.find_by(id: search_context[:id].to_i)
context_obj = klass.find_by(id: search_context[:id]) elsif 'topic' == search_context[:type]
context_obj = Topic.find_by(id: search_context[:id].to_i)
end end
type_filter = nil type_filter = nil