IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

FIX: Better param guards for wiki and post_type posts controller.

Browse Source
This commit is contained in:
Alan Guo Xiang Tan
2022-01-24 15:56:18 +08:00
parent 930f51e175
commit 65f46ad4ed
2 changed files with 27 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
app/controllers/posts_controller.rb
View File

@@ -546,6 +546,7 @@ class PostsController < ApplicationController
def wiki
post = find_post_from_params
params.require(:wiki)
guardian.ensure_can_wiki!(post)
post.revise(current_user, wiki: params[:wiki])
@@ -555,8 +556,10 @@ class PostsController < ApplicationController
def post_type
guardian.ensure_can_change_post_type!
post = find_post_from_params
params.require(:post_type)
raise Discourse::InvalidParameters.new(:post_type) if Post.types[params[:post_type].to_i].blank?
post.revise(current_user, post_type: params[:post_type].to_i)
render body: nil