fix vulnerability

2021-11-18 14:32:20 +08:00 · 2021-11-18 14:32:20 +08:00 · ca55f99f53
parent ef669084a7
commit ca55f99f53
1 changed files with 3 additions and 0 deletions
--- a/app/controllers/asks_controller.rb
+++ b/app/controllers/asks_controller.rb
@ -160,6 +160,9 @@ class AsksController < ActionController::Base
  end

  def create
+    if !params[:referer_url].blank? && !params[:referer_url].to_s.start_with?("/")
+      render :file => "#{Rails.root}/app/views/errors/403.html", :layout => false, :status => 403 and return
+    end
    @ask_question = AskQuestion.new()
    temp_params = create_params
    all_to_save = []