Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SECURITY: User action route was returning too much data

This commit is contained in:
Robin Ward 2014-08-29 13:46:50 -04:00
parent 16c9f073b5
commit 926e45d030
2 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
app/assets/javascripts/discourse/models/user.js
View File

@ -256,9 +256,10 @@ Discourse.User = Discourse.Model.extend({
var self = this, var self = this,
stream = this.get('stream'); stream = this.get('stream');
return Discourse.ajax("/user_actions/" + id + ".json", { cache: 'false' }).then(function(result) { return Discourse.ajax("/user_actions/" + id + ".json", { cache: 'false' }).then(function(result) {
if (result) { if (result && result.user_action) {
if ((self.get('stream.filter') || result.action_type) !== result.action_type) return; var ua = result.user_action;
var action = Discourse.UserAction.collapseStream([Discourse.UserAction.create(result)]); if ((self.get('stream.filter') || ua.action_type) !== ua.action_type) return;
var action = Discourse.UserAction.collapseStream([Discourse.UserAction.create(ua)]);
stream.set('itemsLoaded', stream.get('itemsLoaded') + 1); stream.set('itemsLoaded', stream.get('itemsLoaded') + 1);
stream.get('content').insertAt(0, action[0]); stream.get('content').insertAt(0, action[0]);
} }

2
app/controllers/user_actions_controller.rb
View File

@ -22,7 +22,7 @@ class UserActionsController < ApplicationController
def show def show
params.require(:id) params.require(:id)
render json: UserAction.stream_item(params[:id], guardian) render_serialized(UserAction.stream_item(params[:id], guardian), UserActionSerializer)
end end
def private_messages def private_messages