4 ms·
The unscoped find issue is fairly easily solved by using devise's current_user in combination with something like cancancan. Let them send anything as a param b
by Polylactic_acid 7y ago
The unscoped find issue is fairly easily solved by using devise's current_user in combination with something like cancancan. Let them send anything as a param but have the controller blow up if the user doesn't have permission to access it.
I suspect an insane number of websites are validated only by the frontend and can be exploited like this.
- greenie_beans 7y agoCan't this be solved with scoping via the pundit gem, as well?
- atom_enger 7y agoYou'd suspect right :) I've had a huge number of bounties from this as a result of finding the pattern first on Reverb.