Issue #3 can be closed, write-up and vuln complete for A4

2013-06-03 01:54:07 -04:00
parent 14251e6f39
commit 2ac771ca50
2 changed files with 55 additions and 5 deletions
@@ -2,10 +2,21 @@ class WorkInfoController < ApplicationController
  
  def index
    @user = User.find_by_user_id(params[:user_id])
-    if !(@user)
+    if !(@user) || @user.admin 
      flash[:error] = "Sorry, no user with that user id exists"
      redirect_to home_dashboard_index_path
    end
  end
+
+=begin
+  # More secure version
+  def index
+    @user = current_user
+    if !(@user) || @user.admin 
+      flash[:error] = "Apologies, looks like something went wrong"
+      redirect_to home_dashboard_index_path
+    end
+  end
+=end  
  
 end