Revert "SECURITY: Fix XSS on unsubscribed page."
This reverts commit 190558db9d
.
This commit is contained in:
parent
190558db9d
commit
6fe604b93e
|
@ -110,7 +110,6 @@ class EmailController < ApplicationController
|
||||||
|
|
||||||
def unsubscribed
|
def unsubscribed
|
||||||
@email = params[:email]
|
@email = params[:email]
|
||||||
raise Discourse::NotFound if !User.find_by_email(params[:email])
|
|
||||||
@topic = Topic.find_by(id: params[:topic_id].to_i) if params[:topic_id]
|
@topic = Topic.find_by(id: params[:topic_id].to_i) if params[:topic_id]
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
|
@ -96,7 +96,6 @@ class InvitesController < ApplicationController
|
||||||
|
|
||||||
guardian.ensure_can_invite_to_forum!(groups)
|
guardian.ensure_can_invite_to_forum!(groups)
|
||||||
topic = Topic.find_by(id: params[:topic_id])
|
topic = Topic.find_by(id: params[:topic_id])
|
||||||
guardian.ensure_can_see_topic?(topic)
|
|
||||||
group_ids = groups.map(&:id)
|
group_ids = groups.map(&:id)
|
||||||
|
|
||||||
invite_exists = Invite.where(email: params[:email], invited_by_id: current_user.id).first
|
invite_exists = Invite.where(email: params[:email], invited_by_id: current_user.id).first
|
||||||
|
|
|
@ -3,12 +3,12 @@
|
||||||
<h2><%=t "unsubscribed.title"%></h2>
|
<h2><%=t "unsubscribed.title"%></h2>
|
||||||
<br>
|
<br>
|
||||||
<p>
|
<p>
|
||||||
<%= t("unsubscribed.description", email: @email, url: path("/my/preferences")).html_safe %>
|
<%=t("unsubscribed.description", email: @email, url: path("/my/preferences")).html_safe %>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<% if @topic %>
|
<% if @topic %>
|
||||||
<p>
|
<p>
|
||||||
<%= t("unsubscribed.topic_description", link: render_topic_title(@topic)).html_safe%>
|
<%=t("unsubscribed.topic_description", link: render_topic_title(@topic)).html_safe%>
|
||||||
</p>
|
</p>
|
||||||
<% end %>
|
<% end %>
|
||||||
</div>
|
</div>
|
||||||
|
|
|
@ -1,13 +0,0 @@
|
||||||
require 'rails_helper'
|
|
||||||
|
|
||||||
RSpec.describe EmailController do
|
|
||||||
describe '#unsubscribed' do
|
|
||||||
describe 'when email is invalid' do
|
|
||||||
it 'should return the right response' do
|
|
||||||
get '/email/unsubscribed', params: { email: 'somerandomstring' }
|
|
||||||
|
|
||||||
expect(response.status).to eq(404)
|
|
||||||
end
|
|
||||||
end
|
|
||||||
end
|
|
||||||
end
|
|
Loading…
Reference in New Issue