Security: Sanitize Remote IP address
Dunno quite how, but evidently, request.ip is manipulable. Make sure it consists of a dotted-quad. Also, correct a typo from the previous revision.
This commit is contained in:
parent
827fb77ad3
commit
d46798dd08
|
@ -412,7 +412,7 @@ class WikiController < ApplicationController
|
|||
def remote_ip
|
||||
ip = request.remote_ip
|
||||
logger.info(ip)
|
||||
ip
|
||||
ip.gsub!(/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/, '\1')
|
||||
end
|
||||
|
||||
def render_atom(hide_description = false, limit = 15)
|
||||
|
|
|
@ -77,7 +77,7 @@ class Page < ActiveRecord::Base
|
|||
|
||||
# Returns the original wiki-word name as separate words, so "MyPage" becomes "My Page".
|
||||
def plain_name
|
||||
web.brackets_only? ? CGI.escapeHTML(name) : CGI.escapHTML(WikiWords.separate(name))
|
||||
web.brackets_only? ? CGI.escapeHTML(name) : CGI.escapeHTML(WikiWords.separate(name))
|
||||
end
|
||||
|
||||
LOCKING_PERIOD = 30.minutes
|
||||
|
|
Loading…
Reference in a new issue