Download as
Browse Code »

Commit 8dd6af1466079778fb6a91be9a3d32d7d90275a6

Authored by Dmitriy Zaporozhets
1 parent 7ebbb6e3
Exists in master and in 4 other branches 6-8-stable, 7-0-stable, 7-0-stable-spb, spb-stable

Sanitize user attrs on model level

Showing 4 changed files with 15 additions and 14 deletions   Show diff stats
Gemfile
  Diff comments   View file @8dd6af1
... ... @@ -118,6 +118,9 @@ gem "d3_rails", "~> 3.1.4"
118 118 # underscore-rails
119 119 gem "underscore-rails", "~> 1.4.4"
120 120  
  121 +# Sanitize user input
  122 +gem "sanitize"
  123 +
121 124 group :assets do
122 125 gem "sass-rails"
123 126 gem "coffee-rails"
... ...
Gemfile.lock
  Diff comments   View file @8dd6af1
... ... @@ -608,6 +608,7 @@ DEPENDENCIES
608 608 redcarpet (~> 2.2.2)
609 609 redis-rails
610 610 rspec-rails
  611 + sanitize
611 612 sass-rails
612 613 sdoc
613 614 seed-fu
... ...
app/controllers/profiles_controller.rb
  Diff comments   View file @8dd6af1
... ... @@ -17,7 +17,7 @@ class ProfilesController < ApplicationController
17 17 end
18 18  
19 19 def update
20   - if @user.update_attributes(user_attributes)
  20 + if @user.update_attributes(params[:user])
21 21 flash[:notice] = "Profile was successfully updated"
22 22 else
23 23 flash[:alert] = "Failed to update profile"
... ... @@ -69,19 +69,6 @@ class ProfilesController < ApplicationController
69 69 @user = current_user
70 70 end
71 71  
72   - def user_attributes
73   - user_attributes = params[:user]
74   -
75   - # Sanitize user input because we dont have strict
76   - # validation for this fields
77   - %w(name skype linkedin twitter bio).each do |attr|
78   - value = user_attributes[attr]
79   - user_attributes[attr] = sanitize(strip_tags(value)) if value.present?
80   - end
81   -
82   - user_attributes
83   - end
84   -
85 72 def authorize_change_password!
86 73 return render_404 if @user.ldap_user?
87 74 end
... ...
app/models/user.rb
  Diff comments   View file @8dd6af1
... ... @@ -116,7 +116,10 @@ class User < ActiveRecord::Base
116 116 validate :namespace_uniq, if: ->(user) { user.username_changed? }
117 117  
118 118 before_validation :generate_password, on: :create
  119 + before_validation :sanitize_attrs
  120 +
119 121 before_save :ensure_authentication_token
  122 +
120 123 alias_attribute :private_token, :authentication_token
121 124  
122 125 delegate :path, to: :namespace, allow_nil: true, prefix: true
... ... @@ -371,4 +374,11 @@ class User < ActiveRecord::Base
371 374 def created_by
372 375 User.find_by_id(created_by_id) if created_by_id
373 376 end
  377 +
  378 + def sanitize_attrs
  379 + %w(name username skype linkedin twitter bio).each do |attr|
  380 + value = self.send(attr)
  381 + self.send("#{attr}=", Sanitize.clean(value)) if value.present?
  382 + end
  383 + end
374 384 end
... ...