mirrors/retrospring
1
0
Fork 1
mirror of https://github.com/Retrospring/retrospring.git synced 2025-03-16 10:19:59 +01:00
Code Issues Projects Releases Packages Wiki Activity

Fix dangerous send exploit

Browse source
This commit is contained in:
Yuki 2015-09-01 18:44:50 +05:30
parent 5d3d3a68e7
commit 4b891b3f70
1 changed files with 14 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
app/controllers/ajax/moderation_controller.rb
View file

@ -174,7 +174,19 @@ class Ajax::ModerationController < ApplicationController
end end
@checked = status @checked = status
target_user.send("#{params[:type]}=", status) case params[:type].downcase
when 'blogger'
target_user.blogger = status
when 'contributor'
target_user.contributor = status
when 'translator'
target_user.translator = status
when 'supporter'
target_user.translator = status
when 'moderator'
target_user.translator = status
when 'admin'
target_user.translator = status
target_user.save! target_user.save!
@message = I18n.t('messages.moderation.privilege.checked', privilege: params[:type]) @message = I18n.t('messages.moderation.privilege.checked', privilege: params[:type])