github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-12-16 10:33:40 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: do not disclose topic titles on /unsubscribed page to unauthorized users

Browse Source
This commit is contained in:
Arpit Jalan 2018-04-15 17:59:58 +05:30
parent 0bf1c476d7
commit 411696b85e
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/controllers/email_controller.rb
View File

@ -110,8 +110,10 @@ class EmailController < ApplicationController
def unsubscribed def unsubscribed
@email = params[:email] @email = params[:email]
raise Discourse::NotFound if !User.find_by_email(params[:email]) user = User.find_by_email(params[:email])
raise Discourse::NotFound unless user
@topic = Topic.find_by(id: params[:topic_id].to_i) if params[:topic_id] @topic = Topic.find_by(id: params[:topic_id].to_i) if params[:topic_id]
raise Discourse::NotFound unless Guardian.new(user).can_see?(@topic)
end end
end end