Raise NotAuthorized Error if ID cannot be found

Fixes CODEOCEAN-F3
This commit is contained in:
Sebastian Serth
2022-11-17 20:38:42 +01:00
parent 61c4d5a894
commit 9bd900bd86

View File

@ -29,7 +29,11 @@ module AuthenticatedUrlHelper
end
cookie_name = AuthenticatedUrlHelper.cookie_name_for(:render_file_token)
object = klass.find(request.parameters[:id])
begin
object = klass.find(request.parameters[:id])
rescue ActiveRecord::RecordNotFound
raise Pundit::NotAuthorizedError
end
signed_url = request.parameters[TOKEN_PARAM].present? ? request.url : cookies[cookie_name]
# Throws an exception if the token is not matching the object or has expired