[PATCH conductor 02/11] validate class names which constantize is called on correspond to db table names

Mo Morsi mmorsi at redhat.com
Thu Jun 21 20:51:50 UTC 2012


---
 src/app/controllers/permissions_controller.rb |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/src/app/controllers/permissions_controller.rb b/src/app/controllers/permissions_controller.rb
index d621e6d..c4d1371 100644
--- a/src/app/controllers/permissions_controller.rb
+++ b/src/app/controllers/permissions_controller.rb
@@ -190,7 +190,11 @@ class PermissionsController < ApplicationController
     unless obj_type or id
       @permission_object = BasePermissionObject.general_permission_scope
     end
-    @permission_object = obj_type.constantize.find(id) if obj_type and id
+    if klass = ActiveRecord::Base.send(:subclasses).find{|c| c.name == obj_type}
+      @permission_object = klass.find(id)
+    else
+      raise RuntimeError, "invalid permission object type #{obj_type}"
+    end
     raise RuntimeError, "invalid permission object" if @permission_object.nil?
     if @permission_object == BasePermissionObject.general_permission_scope
       @return_path = permissions_path
-- 
1.7.6.5




More information about the aeolus-devel mailing list