github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-30 15:28:37 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Fix XSS on unsubscribed page.

Browse Source
This commit is contained in:
Guo Xiang Tan
2017-10-09 08:59:03 +08:00
parent 4ea87b5ab8
commit 190558db9d
4 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
app/controllers/email_controller.rb
View File

@ -110,6 +110,7 @@ class EmailController < ApplicationController
def unsubscribed
@email = params[:email]
raise Discourse::NotFound if !User.find_by_email(params[:email])
@topic = Topic.find_by(id: params[:topic_id].to_i) if params[:topic_id]
end