[PATCH conductor 03/13] validate class names which constantize is called on correspond to db table names

Mo Morsi mmorsi at redhat.com
Thu May 17 13:39:57 UTC 2012


---
 src/app/controllers/permissions_controller.rb |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/src/app/controllers/permissions_controller.rb b/src/app/controllers/permissions_controller.rb
index 9e8ba51..01fddab 100644
--- a/src/app/controllers/permissions_controller.rb
+++ b/src/app/controllers/permissions_controller.rb
@@ -192,7 +192,11 @@ class PermissionsController < ApplicationController
     unless obj_type or id
       @permission_object = BasePermissionObject.general_permission_scope
     end
-    @permission_object = obj_type.constantize.find(id) if obj_type and id
+    if klass = ActiveRecord::Base.send(:subclasses).find{|c| c.name == obj_type}
+      @permission_object = klass.find(id)
+    else
+      raise RuntimeError, "invalid permission object type #{obj_type}"
+    end
     raise RuntimeError, "invalid permission object" if @permission_object.nil?
     if @permission_object == BasePermissionObject.general_permission_scope
       @return_path = permissions_path
-- 
1.7.6.5




More information about the aeolus-devel mailing list