Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

security fix for plan policy #3084

Closed
wants to merge 2 commits into from
Closed

security fix for plan policy #3084

wants to merge 2 commits into from

Conversation

raycarrick-ed
Copy link
Contributor

Fixes security issue with plan policy.

Changes proposed in this PR:

  • authorize on index method in contributors controller had no effect in essence allowing anyone access to any plan. See ticket above for an example. This change requires the :show? policy to be satisfied.

@raycarrick-ed
Copy link
Contributor Author

Latest commit was trying to sort out rubocop issues. Will continue with the rest later.

@raycarrick-ed raycarrick-ed mentioned this pull request Jan 25, 2022
Closed
@raycarrick-ed raycarrick-ed deleted the plan_policy_bug branch January 28, 2022 12:46
@briri briri mentioned this pull request Feb 14, 2022
Merged
@laurastandaert laurastandaert mentioned this pull request Feb 24, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@briri briri Awaiting requested review from briri

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@raycarrick-ed