From c0931e7f5fd55bbdfb4e31ed944ca0e65870cf98 Mon Sep 17 00:00:00 2001 From: bohung Date: Mon, 24 Oct 2022 16:19:31 +0800 Subject: [PATCH] Fix vulnerable. --- app/controllers/admin/experiences_controller.rb | 4 ++-- app/controllers/personal_experiences_controller.rb | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/app/controllers/admin/experiences_controller.rb b/app/controllers/admin/experiences_controller.rb index 04e94f2..0b4cf8c 100644 --- a/app/controllers/admin/experiences_controller.rb +++ b/app/controllers/admin/experiences_controller.rb @@ -15,7 +15,7 @@ class Admin::ExperiencesController < OrbitMemberController end def new - @member = MemberProfile.find_by(:uid=>params['uid']) rescue nil + @member = MemberProfile.find_by(:uid=>params['uid'].to_s) rescue nil @experience = Experience.new if params[:desktop] render :layout => false @@ -163,7 +163,7 @@ class Admin::ExperiencesController < OrbitMemberController end def frontend_setting - @member = MemberProfile.find_by(:uid=>params['uid']) rescue nil + @member = MemberProfile.find_by(:uid=>params['uid'].to_s) rescue nil @intro = ExperienceIntro.find_by(:member_profile_id=>@member.id) rescue nil @intro = @intro.nil? ? ExperienceIntro.new({:member_profile_id=>@member.id}) : @intro end diff --git a/app/controllers/personal_experiences_controller.rb b/app/controllers/personal_experiences_controller.rb index 886a55e..8bf229c 100644 --- a/app/controllers/personal_experiences_controller.rb +++ b/app/controllers/personal_experiences_controller.rb @@ -28,7 +28,7 @@ class PersonalExperiencesController < ApplicationController def show params = OrbitHelper.params - plugin = Experience.where(:is_hidden=>false).find_by(uid: params[:uid]) + plugin = Experience.where(:is_hidden=>false).find_by(uid: params[:uid].to_s) fields_to_show = [ "experience_type",