[PATCH conductor 1/1] sanitize the use of details_tab param
Mo Morsi
mmorsi at redhat.com
Tue Jun 5 12:52:17 UTC 2012
On 05/28/2012 03:00 PM, Samridh wrote:
> ---
> .../controllers/provider_accounts_controller.rb | 1 +
> 1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/src/app/controllers/provider_accounts_controller.rb b/src/app/controllers/provider_accounts_controller.rb
> index bf48af3..81f841d 100644
> --- a/src/app/controllers/provider_accounts_controller.rb
> +++ b/src/app/controllers/provider_accounts_controller.rb
> @@ -41,6 +41,7 @@ class ProviderAccountsController < ApplicationController
> @account_id = @provider_account.credentials_hash['account_id']
> require_privilege(Privilege::VIEW, @provider_account)
> @details_tab = params[:details_tab].blank? ? 'properties' : params[:details_tab]
> + @details_tab = 'properties' unless ['properties'].include?(@details_tab)
>
> add_permissions_inline(@provider_account)
> if params.delete :test_account
ACK and pushed
-Mo
More information about the aeolus-devel
mailing list