edshot99/eBooru
1
0
Fork 0
forked from e621ng/e621ng
Code Issues 11 Releases 1 Activity

[Comments] Prevent hidden comment leak in API

Browse Source
This commit is contained in:
Kira 2020-05-20 18:32:31 -07:00
parent 2c40167c39
commit b47e837ee5
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
app/controllers/comments_controller.rb
View File

@ -54,6 +54,7 @@ class CommentsController < ApplicationController
def show
@comment = Comment.find(params[:id])
check_visible(@comment)
@comment_votes = CommentVote.for_comments_and_user([@comment.id], CurrentUser.id)
respond_with(@comment)
end
@ -105,6 +106,12 @@ private
end
end
def check_visible(comment)
if !comment.visible_to?(CurrentUser.user)
raise User::PrivilegeError
end
end
def comment_params(context)
permitted_params = %i[body post_id]
permitted_params += %i[do_not_bump_post] if context == :create