Avoid a brakeman warning in related contents

Although it wasn't a real security concern because we were only calling
a `find_by` method based on the user input, it's a good practice to
avoid using constants based on user parameters.

Since we don't use the `find_by` method anymore but we still need to
check the associated record exists, we're changing the validations in
the `RelatedContent` model to do exactly that.
This commit is contained in:
Javi Martín
2021-06-23 04:26:07 +02:00
parent 8f20ee1a33
commit 48dc72cea9
4 changed files with 32 additions and 16 deletions

View File

@@ -4,10 +4,10 @@ class RelatedContentsController < ApplicationController
respond_to :html, :js
def create
related_content = RelatedContent.new(
parent_relationable: relationable_object,
child_relationable: related_object,
author: current_user
related_content = current_user.related_contents.new(
parent_relationable_id: params[:relationable_id],
parent_relationable_type: params[:relationable_klass],
child_relationable: related_object
)
if related_content.save
@@ -17,7 +17,7 @@ class RelatedContentsController < ApplicationController
else
flash[:error] = t("related_content.error", url: Setting["url"])
end
redirect_to polymorphic_path(relationable_object)
redirect_to polymorphic_path(related_content.parent_relationable)
end
def score_positive
@@ -41,10 +41,6 @@ class RelatedContentsController < ApplicationController
params[:url].start_with?(Setting["url"])
end
def relationable_object
@relationable ||= params[:relationable_klass].singularize.camelize.constantize.find_by(id: params[:relationable_id])
end
def related_object
if valid_url?
url = params[:url]