SECURITY: mini profiler enabled incorrectly for admins
We expect mini profiler only to show up on accounts that are flagged as developer accounts. Unfortunately there was a bypass on any controllers that mix in ApplicationHelper
This commit is contained in:
parent
49a4b0dd9c
commit
602215a273
|
@ -185,10 +185,6 @@ module ApplicationHelper
|
||||||
@guardian ||= Guardian.new(current_user)
|
@guardian ||= Guardian.new(current_user)
|
||||||
end
|
end
|
||||||
|
|
||||||
def mini_profiler_enabled?
|
|
||||||
defined?(Rack::MiniProfiler) && admin?
|
|
||||||
end
|
|
||||||
|
|
||||||
def admin?
|
def admin?
|
||||||
current_user.try(:admin?)
|
current_user.try(:admin?)
|
||||||
end
|
end
|
||||||
|
|
Loading…
Reference in New Issue