Correcting some security warnings

remotes/origin/master
echarp 4 years ago
parent 2cd11098f4
commit a372b962ab
  1. 8
      app/controllers/events_controller.rb
  2. 2
      app/views/events/show.html.haml
  3. 4
      app/views/orgas/_form.html.haml
  4. 2
      app/views/orgas/show.html.haml
  5. 2
      config/application.rb
  6. 1
      config/initializers/paper_trail.rb

@ -4,11 +4,11 @@ class EventsController < ApplicationController
has_scope :region, :locality, :tag, :daylimit, :year
has_scope :near, type: :hash, using: %i[location distance]
before_action :set_events, only: [:index]
before_action :set_events, only: :index
before_action :set_event, except: %i[index new preview_create create]
before_action :set_create_event, only: %i[new preview_create create]
before_action :check_secret, only: %i[edit preview update destroy]
before_action :set_mailer_host
before_action :set_mailer_host, only: %i[create update destroy]
rescue_from ActiveRecord::StaleObjectError, with: :locked
def index
@ -88,9 +88,7 @@ class EventsController < ApplicationController
# Use callbacks to share common setup or constraints between actions
def set_event
@event = Event.moderated
@event = Event.where secret: params[:secret] if params[:secret].present?
@event = @event.find params[:id]
@event = Event.find params[:id]
end
def set_create_event

@ -55,7 +55,7 @@
%p
%em.fa.fa-external-link-alt
%span.label= Event.human_attribute_name :url
= link_to @event.url, sanitize(@event.url)
= link_to @event.url, @event.url.html_safe
- if @event.contact.present?
%p
%em.fa.fa-envelope

@ -31,8 +31,8 @@
= f.label :city
= f.text_field :city, list: :cities
%datalist#cities
- Event.group(:city).order('count(city) desc').pluck(:city).each do |city|
%option= city
- Event.group(:city).order('1 desc').count.each do |r|
%option= r[0]
.field.department
= f.label :department
= f.text_field :department

@ -39,7 +39,7 @@
%dt.url
%em.fa.fa-external-link-alt
= Orga.human_attribute_name :url
%dd= link_to @orga.url, sanitize(@orga.url)
%dd= link_to @orga.url, @orga.url.html_safe
- if @orga.diaspora.present?
%dt.diaspora<
= Orga.human_attribute_name :diaspora

@ -47,5 +47,7 @@ module AgendaDuLibreRails
# time being
# TODO
config.action_controller.per_form_csrf_tokens = false
config.active_record.sqlite3.represent_boolean_as_integer = true
end
end

@ -1 +0,0 @@
PaperTrail.config.track_associations = false
Loading…
Cancel
Save