mirror of
https://github.com/discourse/discourse.git
synced 2026-08-05 17:25:34 +08:00
b2c3c1cae8## Summary The /clicks/track endpoint allowed users to manipulate click counts for links inside private messages and restricted topics they could not access. This integrity issue is resolved by passing the user's guardian to the model layer and verifying visibility before recording the click. ## Source - Patch Triage: https://patch.discourse.org/patch-triage/1148 - HackerOne report: https://hackerone.com/reports/3701904 --- 🤖 Auto-generated from the patch diff via Patch Triage. Review carefully before merging. Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com> --------- Co-authored-by: discourse-patch-triage[bot] <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
20 lines
472 B
Ruby
Vendored
20 lines
472 B
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
class ClicksController < ApplicationController
|
|
skip_before_action :check_xhr, :preload_json, :verify_authenticity_token
|
|
|
|
def track
|
|
params.require(%i[url post_id topic_id])
|
|
|
|
TopicLinkClick.create_from(
|
|
url: params[:url],
|
|
post_id: params[:post_id],
|
|
topic_id: params[:topic_id],
|
|
ip: request.remote_ip,
|
|
user_id: current_user&.id,
|
|
guardian: guardian,
|
|
)
|
|
|
|
render json: success_json
|
|
end
|
|
end
|
