cktricky 95eb5a56fd added vulnerable auth check for the API

2014-03-12 15:40:12 -04:00

..

api/v1

added vulnerable auth check for the API

2014-03-12 15:40:12 -04:00

admin_controller.rb

I think there was a subtle bug in the intentional security bypass within the admin controller

2013-11-14 15:05:00 -05:00

application_controller.rb

adding password rest method and changing some logic around

2013-12-11 22:25:02 -05:00

benefit_forms_controller.rb

working command injection in fileupload, closes issue #23

2013-07-09 16:36:03 -04:00

dashboard_controller.rb

we are going to fix this by automatically generating data for ppl that register HOWEVER, just in case that fails for some reason, I have applied a filter that ensures if some data is not associated with a person they cannot navigate to all aspects of the application. This is a preventive measure

2013-05-31 19:02:00 -04:00

messages_controller.rb

adding messaging function, needs tests...

2013-10-13 21:49:17 -04:00

paid_time_off_controller.rb

made some big changes here. The schedule had a has_one relationship with the PTO model. That is a problem since we only get one result back. meaning, a user cant have multiple scheduled events. This has been fixed with the use of has_many within the PTO model. Now, in relation to the PTO section, the next changes to happen are to be a fully functional create action that allows an event to be schedule, the form and controller has already been created. Umm, also, a calendar has been added and when we get the results back from a call to the create event action we will update that calendar. Think that is about it for now

2013-05-28 12:48:35 -04:00

password_resets_controller.rb

adding password rest method and changing some logic around

2013-12-11 22:25:02 -05:00

performance_controller.rb

added visualization chart for performance history

2013-05-31 15:20:58 -04:00

retirement_controller.rb

moving in the right direction

2013-05-24 19:51:09 -04:00

schedule_controller.rb

so now, when you add a PTO scheduled date, the calendar on your PTO page automatically updates to show this event :-)

2013-05-31 10:31:35 -04:00

sessions_controller.rb

okay, finally got a working redirect vuln

2013-06-04 11:00:01 -04:00

tutorials_controller.rb

fixes a bug introduced during the transition from info_disclosure to A6

2013-11-14 11:06:27 -05:00

users_controller.rb

adding password rest method and changing some logic around

2013-12-11 22:25:02 -05:00

work_info_controller.rb

Issue #3 can be closed, write-up and vuln complete for A4

2013-06-03 01:54:07 -04:00