From 3ddd9f753c0a6a57313ea4860bf7167f98f53cd2 Mon Sep 17 00:00:00 2001 From: Dmitriy Zaporozhets Date: Fri, 25 Jan 2013 15:42:41 +0200 Subject: [PATCH] Fix mass-assignment. Dont allow users w/o access to create team --- app/controllers/application_controller.rb | 4 ++++ app/controllers/teams_controller.rb | 11 ++++------- app/models/user.rb | 2 +- 3 files changed, 9 insertions(+), 8 deletions(-) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index f903c7fd..74125e33 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -94,6 +94,10 @@ class ApplicationController < ActionController::Base return access_denied! unless can?(current_user, :download_code, project) end + def authorize_create_team! + return access_denied! unless can?(current_user, :create_team, nil) + end + def authorize_manage_user_team! return access_denied! unless user_team.present? && can?(current_user, :manage_user_team, user_team) end diff --git a/app/controllers/teams_controller.rb b/app/controllers/teams_controller.rb index 7de09421..828bdeb8 100644 --- a/app/controllers/teams_controller.rb +++ b/app/controllers/teams_controller.rb @@ -1,13 +1,10 @@ class TeamsController < ApplicationController # Authorize - before_filter :authorize_manage_user_team! - before_filter :authorize_admin_user_team! + before_filter :authorize_create_team!, only: [:new, :create] + before_filter :authorize_manage_user_team!, only: [:edit, :update] + before_filter :authorize_admin_user_team!, only: [:destroy] - # Skip access control on public section - skip_before_filter :authorize_manage_user_team!, only: [:index, :show, :new, :destroy, :create, :search, :issues, :merge_requests] - skip_before_filter :authorize_admin_user_team!, only: [:index, :show, :new, :create, :search, :issues, :merge_requests] - - layout 'user_team', only: [:show, :edit, :update, :destroy, :issues, :merge_requests, :search] + layout 'user_team', except: [:new, :create] def index @teams = current_user.user_teams.order('name ASC') diff --git a/app/models/user.rb b/app/models/user.rb index 8ef8ecda..7a0d6645 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -40,7 +40,7 @@ class User < ActiveRecord::Base attr_accessible :email, :password, :password_confirmation, :remember_me, :bio, :name, :username, :skype, :linkedin, :twitter, :dark_scheme, :theme_id, :force_random_password, :extern_uid, :provider, as: [:default, :admin] - attr_accessible :projects_limit, as: :admin + attr_accessible :projects_limit, :can_create_team, :can_create_group, as: :admin attr_accessor :force_random_password