IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

SECURITY: Limit user profile field length (#18302)

Browse Source 
Adds limits to location and website fields at model and DB level
to match the bio_raw field limits. A limit cannot be added at the
DB level for bio_raw because it is a postgres text field.

Co-authored-by: Alan Guo Xiang Tan <gxtan1990@gmail.com>
This commit is contained in:
Martin Brennan
2022-09-21 12:07:06 +10:00
committed by GitHub
parent b98cd73ace
commit e69f7d2fd9
3 changed files with 38 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
db/migrate/20220920044310_enforce_user_profile_max_limits.rb Normal file
View File

@@ -0,0 +1,11 @@
# frozen_string_literal: true
class EnforceUserProfileMaxLimits < ActiveRecord::Migration[7.0]
def change
execute "UPDATE user_profiles SET location = LEFT(location, 3000) WHERE location IS NOT NULL"
execute "UPDATE user_profiles SET website = LEFT(website, 3000) WHERE website IS NOT NULL"
change_column :user_profiles, :location, :string, limit: 3000
change_column :user_profiles, :website, :string, limit: 3000
end
end