Commit graph

6 commits

Author SHA1 Message Date
Rémy Coutable
aec3475df9
Fix an information disclosure when requesting access to a group containing private projects
The issue was with the `User#groups` and `User#projects` associations
which goes through the `User#group_members` and `User#project_members`.

Initially I chose to use a secure approach by storing the requester's
user ID in `Member#created_by_id` instead of `Member#user_id` because I
was aware that there was a security risk since I didn't know the
codebase well enough.

Then during the review, we decided to change that and directly store the
requester's user ID into `Member#user_id` (for the sake of simplifying
the code I believe), meaning that every `group_members` / `project_members`
association would include the requesters by default...

My bad for not checking that all the `group_members` / `project_members`
associations and the ones that go through them (e.g. `Group#users` and
`Project#users`) were made safe with the `where(requested_at: nil)` /
`where(members: { requested_at: nil })` scopes.

Now they are all secure.

Signed-off-by: Rémy Coutable <remy@rymai.me>
2016-06-24 12:01:48 +02:00
Robert Speicher
085538c2bd Use the configured Kaminari "per page" default 2016-03-19 17:37:54 -04:00
Douwe Maan
26ad250989 Add a page title to every page. 2015-04-30 19:12:15 +02:00
Douwe Maan
84371de01f Move group leave action from dashboard/groups to groups/group_members. 2015-03-15 13:52:28 +01:00
Dmitriy Zaporozhets
f0cbbd70bb Use same constant for amount of items per page 2015-03-12 15:37:00 -07:00
Dmitriy Zaporozhets
9b3e156e43 Move profile groups page to dashboard 2015-03-08 17:03:30 -07:00
Renamed from app/controllers/profiles/groups_controller.rb (Browse further)