mirror of
https://github.com/discourse/discourse.git
synced 2024-11-25 10:20:58 -06:00
7b53e610c1
The watch words controller creation function, create_or_update_word(), doesn’t validate the size of the replacement parameter, unlike the word parameter, when creating a replace watched word. So anyone with moderator privileges can create watched words with almost unlimited characters.
7 lines
160 B
Ruby
7 lines
160 B
Ruby
# frozen_string_literal: true
|
|
|
|
Fabricator(:watched_word_group) do
|
|
action WatchedWord.actions[:block]
|
|
watched_words { [Fabricate.build(:watched_word)] }
|
|
end
|