Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
discourse/app/controllers/admin
History
Andrei Prigorshnev 5a2ad7e386
DEV: remove calls to guardian from GroupActionLogger (#13835) 
We shouldn't be checking if a user is allowed to do an action in the logger. We should be checking it just before we perform the action. In fact, guardians in the logger can make things even worse in case of a security bug. Let's say we forgot to check user's permissions before performing some action, but we still have a call to the guardian in the logger. In this case, a user would perform the action anyway, and this action wouldn't even be logged!

I've checked all cases and I confirm that we're safe to delete this calls from the logger.

I've added two calls to guardians in admin/user_controller. We didn't have security bugs there, because regular users can't access admin/... routes at all. But it's good to have calls to guardian in these methods anyway, neighboring methods have them.
 		2021-07-28 15:04:04 +04:00
..
admin_controller.rb DEV: add a few frozen string literals 2019-05-02 16:57:12 +10:00
api_controller.rb FIX: Allow plugins to correctly extend API key scopes. (#12113) 2021-02-17 14:42:44 -03:00
backups_controller.rb DEV: Upgrade Rails to 6.1.3.1 (#12688) 2021-04-21 12:36:32 +03:00
badges_controller.rb FEATURE: Add option to grant badge multiple times to users using Bulk Award (#13571) 2021-07-15 05:53:26 +03:00
color_schemes_controller.rb FEATURE: User selectable color schemes (#10544) 2020-08-28 10:36:52 -04:00
dashboard_controller.rb UX: Changes to new features section in admin dashboard (#12029) 2021-02-10 13:12:04 -05:00
email_controller.rb FIX: Catch UndefinedConversionError for inbound emails (#13000) 2021-05-10 14:26:23 +10:00
email_styles_controller.rb FEATURE: customization of html emails (#7934) 2019-07-30 15:05:08 -04:00
email_templates_controller.rb Add bad_destination_address template to email_templates_controller (#12102) 2021-02-17 09:57:38 +01:00
embeddable_hosts_controller.rb FIX: use allowlist and blocklist terminology (#10209) 2020-07-27 10:23:54 +10:00
embedding_controller.rb DEV: Upgrading Discourse to Zeitwerk (#8098) 2019-10-02 14:01:53 +10:00
emojis_controller.rb FEATURE: allows multiple custom emoji groups (#9308) 2020-03-30 20:16:10 +02:00
groups_controller.rb DEV: Remove bulk group admin endpoints (#11949) 2021-02-03 18:12:22 +01:00
impersonate_controller.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
permalinks_controller.rb FEATURE: Permalinks for tags 2020-05-25 14:51:01 +02:00
plugins_controller.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
reports_controller.rb FIX: Only cache reports with exceptions for 1 minute (#11447) 2020-12-09 10:54:41 -06:00
robots_txt_controller.rb FEATURE: Allow customization of robots.txt (#7884) 2019-07-15 20:47:44 +03:00
screened_emails_controller.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
screened_ip_addresses_controller.rb DEV: Upgrading Discourse to Zeitwerk (#8098) 2019-10-02 14:01:53 +10:00
screened_urls_controller.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
search_logs_controller.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
site_settings_controller.rb FEATURE: Treat site settings as plain text and add a new HTML type. (#12618) 2021-04-07 12:51:19 -03:00
site_texts_controller.rb FIX: I18n couldn't find translations. (#11774) 2021-01-20 17:43:00 -03:00
staff_action_logs_controller.rb FIX: Don't error when the empty current value in dif (#8406) 2019-11-26 09:17:14 +11:00
themes_controller.rb PERF: Remove N+1s from ThemeController#update and #show (#12842) 2021-04-27 12:30:29 +01:00
user_fields_controller.rb FEATURE: Add user custom fields to user directory (#13238) 2021-06-07 12:34:01 -05:00
users_controller.rb DEV: remove calls to guardian from GroupActionLogger (#13835) 2021-07-28 15:04:04 +04:00
versions_controller.rb DEV: Upgrading Discourse to Zeitwerk (#8098) 2019-10-02 14:01:53 +10:00
watched_words_controller.rb FEATURE: add staff action logs for watched words (#13574) 2021-06-30 11:22:46 +05:30
web_hooks_controller.rb FIX: Don't display webhooks for inactive plugins (#9206) 2020-03-17 10:39:24 -06:00