Unfloyded/Legamunt
0
0
Fork 0
Code Activity

Fix invalid votes from the API being accepted (#12601)

Browse source 
* Fix invalid votes from the API being accepted

Fixes #12556

- Ensure `choice` is an integer instead of silently converting to 0
- Ensure `choice` corresponds to an actual choice of the poll

* Please CodeClimate
This commit is contained in:
ThibG 2020-01-12 14:17:03 +01:00 • committed by Eugen Rochko
parent 7da54001fe
commit d386d89179
3 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
app/validators/vote_validator.rb
View file

@ -4,10 +4,18 @@ class VoteValidator < ActiveModel::Validator
def validate(vote)
vote.errors.add(:base, I18n.t('polls.errors.expired')) if vote.poll.expired?
vote.errors.add(:base, I18n.t('polls.errors.invalid_choice')) if invalid_choice?(vote)
if vote.poll.multiple? && vote.poll.votes.where(account: vote.account, choice: vote.choice).exists?
vote.errors.add(:base, I18n.t('polls.errors.already_voted'))
elsif !vote.poll.multiple? && vote.poll.votes.where(account: vote.account).exists?
vote.errors.add(:base, I18n.t('polls.errors.already_voted'))
end
end
private
def invalid_choice?(vote)
vote.choice.negative? || vote.choice >= vote.poll.options.size
end
end