Revert "SECURITY: Fix XSS on unsubscribed page."

This reverts commit 190558db9d.
This commit is contained in:
Guo Xiang Tan 2017-10-09 09:03:07 +08:00
parent 190558db9d
commit 6fe604b93e
4 changed files with 2 additions and 17 deletions

View File

@ -110,7 +110,6 @@ class EmailController < ApplicationController
def unsubscribed
@email = params[:email]
raise Discourse::NotFound if !User.find_by_email(params[:email])
@topic = Topic.find_by(id: params[:topic_id].to_i) if params[:topic_id]
end

View File

@ -96,7 +96,6 @@ class InvitesController < ApplicationController
guardian.ensure_can_invite_to_forum!(groups)
topic = Topic.find_by(id: params[:topic_id])
guardian.ensure_can_see_topic?(topic)
group_ids = groups.map(&:id)
invite_exists = Invite.where(email: params[:email], invited_by_id: current_user.id).first

View File

@ -3,12 +3,12 @@
<h2><%=t "unsubscribed.title"%></h2>
<br>
<p>
<%= t("unsubscribed.description", email: @email, url: path("/my/preferences")).html_safe %>
<%=t("unsubscribed.description", email: @email, url: path("/my/preferences")).html_safe %>
</p>
<% if @topic %>
<p>
<%= t("unsubscribed.topic_description", link: render_topic_title(@topic)).html_safe%>
<%=t("unsubscribed.topic_description", link: render_topic_title(@topic)).html_safe%>
</p>
<% end %>
</div>

View File

@ -1,13 +0,0 @@
require 'rails_helper'
RSpec.describe EmailController do
describe '#unsubscribed' do
describe 'when email is invalid' do
it 'should return the right response' do
get '/email/unsubscribed', params: { email: 'somerandomstring' }
expect(response.status).to eq(404)
end
end
end
end