osr-plastic/osr-discourse-src
Archived
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

SECURITY: User action route was returning too much data

Browse Source
This commit is contained in:
Robin Ward
2014-08-29 13:46:50 -04:00
parent 16c9f073b5
commit 926e45d030
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/assets/javascripts/discourse/models/user.js
+4 -3
View File
@@ -256,9 +256,10 @@ Discourse.User = Discourse.Model.extend({
var self = this,
stream = this.get('stream');
return Discourse.ajax("/user_actions/" + id + ".json", { cache: 'false' }).then(function(result) {
if (result) {
if ((self.get('stream.filter') || result.action_type) !== result.action_type) return;
var action = Discourse.UserAction.collapseStream([Discourse.UserAction.create(result)]);
if (result && result.user_action) {
var ua = result.user_action;
if ((self.get('stream.filter') || ua.action_type) !== ua.action_type) return;
var action = Discourse.UserAction.collapseStream([Discourse.UserAction.create(ua)]);
stream.set('itemsLoaded', stream.get('itemsLoaded') + 1);
stream.get('content').insertAt(0, action[0]);
}