heckyel/mediagoblin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Three fixes to collection adding view, one of them a serious security bug

Browse Source 
- Don't let people who aren't the authors of a collection from adding
   things to it (handled by forcing the user check in the query)
 - request url in case invalid collection selected fixed
 - collection_item.author doesn't yet exist; removing the selection
   (we might want multiple people to be able to edit a collection in
   the future but that future does not yet exist; as Elrond said,
   remove this "false hope")

Thanks to Elrond to pointing out these issues.

And thanks to David Kindler for sponsoring this commit!
This commit is contained in:
Christopher Allan Webber 2013-03-04 10:12:48 -06:00
parent 3ff4f75203
commit 17e4679ddc
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
mediagoblin/user_pages/views.py
View File

@ -227,7 +227,8 @@ def media_collect(request, media):
# Otherwise, use the collection selected from the drop-down # Otherwise, use the collection selected from the drop-down
else: else:
collection = Collection.query.filter_by( collection = Collection.query.filter_by(
id=request.form.get('collection')).first() id=request.form.get('collection'),
creator=request.user.id).first()
# Make sure the user actually selected a collection # Make sure the user actually selected a collection
if not collection: if not collection:
@ -236,7 +237,7 @@ def media_collect(request, media):
_('You have to select or add a collection')) _('You have to select or add a collection'))
return redirect(request, "mediagoblin.user_pages.media_collect", return redirect(request, "mediagoblin.user_pages.media_collect",
user=media.get_uploader.username, user=media.get_uploader.username,
media=media.id) media_id=media.id)
# Check whether media already exists in collection # Check whether media already exists in collection
@ -250,7 +251,6 @@ def media_collect(request, media):
collection_item = request.db.CollectionItem() collection_item = request.db.CollectionItem()
collection_item.collection = collection.id collection_item.collection = collection.id
collection_item.media_entry = media.id collection_item.media_entry = media.id
collection_item.author = request.user.id
collection_item.note = request.form['note'] collection_item.note = request.form['note']
collection_item.save() collection_item.save()