github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-12-16 05:23:48 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: User action route was returning too much data

Browse Source
This commit is contained in:
Robin Ward 2014-08-29 13:46:50 -04:00
parent 9ad246affe
commit 8ced44a766
2 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
app/assets/javascripts/discourse/models/user.js
View File

@ -256,9 +256,10 @@ Discourse.User = Discourse.Model.extend({
var self = this,
stream = this.get('stream');
return Discourse.ajax("/user_actions/" + id + ".json", { cache: 'false' }).then(function(result) {
if (result) {
if ((self.get('stream.filter') || result.action_type) !== result.action_type) return;
var action = Discourse.UserAction.collapseStream([Discourse.UserAction.create(result)]);
if (result && result.user_action) {
var ua = result.user_action;
if ((self.get('stream.filter') || ua.action_type) !== ua.action_type) return;
var action = Discourse.UserAction.collapseStream([Discourse.UserAction.create(ua)]);
stream.set('itemsLoaded', stream.get('itemsLoaded') + 1);
stream.get('content').insertAt(0, action[0]);
}

2
app/controllers/user_actions_controller.rb
View File

@ -22,7 +22,7 @@ class UserActionsController < ApplicationController
def show
params.require(:id)
render json: UserAction.stream_item(params[:id], guardian)
render_serialized(UserAction.stream_item(params[:id], guardian), UserActionSerializer)
end
def private_messages