SECURITY: Don't leak topic title in the redirect

2025-06-03 02:48:28 +08:00 · 2015-02-04 11:49:05 -08:00
parent 3948a960cd
commit 4c8850108a
2 changed files with 17 additions and 0 deletions
--- a/app/controllers/posts_controller.rb
+++ b/app/controllers/posts_controller.rb
@ -70,6 +70,8 @@ class PostsController < ApplicationController
      user = User.find(params[:user_id].to_i)
      request['u'] = user.username_lower if user
    end
+
+    guardian.ensure_can_see!(post)
    redirect_to post.url
  end