[PATCH conductor 1/1] sanitize the use of details_tab param

Mo Morsi mmorsi at redhat.com
Tue Jun 5 12:52:17 UTC 2012


On 05/28/2012 03:00 PM, Samridh wrote:
> ---
>  .../controllers/provider_accounts_controller.rb    |    1 +
>  1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/src/app/controllers/provider_accounts_controller.rb b/src/app/controllers/provider_accounts_controller.rb
> index bf48af3..81f841d 100644
> --- a/src/app/controllers/provider_accounts_controller.rb
> +++ b/src/app/controllers/provider_accounts_controller.rb
> @@ -41,6 +41,7 @@ class ProviderAccountsController < ApplicationController
>      @account_id = @provider_account.credentials_hash['account_id']
>      require_privilege(Privilege::VIEW, @provider_account)
>      @details_tab = params[:details_tab].blank? ? 'properties' : params[:details_tab]
> +    @details_tab = 'properties' unless ['properties'].include?(@details_tab)
>  
>      add_permissions_inline(@provider_account)
>      if params.delete :test_account

ACK and pushed

  -Mo



More information about the aeolus-devel mailing list