htwkmooc/codeocean
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cleanup of passed parameters, user_id and user_type are extracted from current user and not used from the passed POST values..

Browse Source
This commit is contained in:
Ralf Teusner
2015-08-19 15:35:25 +02:00
parent e520914385
commit dc0b3a2294
3 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/request_for_comments_controller.rb
View File

@ -66,6 +66,6 @@ class RequestForCommentsController < ApplicationController
# Never trust parameters from the scary internet, only allow the white list through.
def request_for_comment_params
params.require(:request_for_comment).permit(:requestor_user_id, :exercise_id, :file_id, :requested_at)
params.require(:request_for_comment).permit(:exercise_id, :file_id, :requested_at).merge(requestor_user_id: current_user.id, user_type: current_user.class.name)
end
end