From d386d89179ccc2b86894a8639b658f4ede24c5f6 Mon Sep 17 00:00:00 2001
From: ThibG <thib@sitedethib.com>
Date: Sun, 12 Jan 2020 14:17:03 +0100
Subject: [PATCH] Fix invalid votes from the API being accepted (#12601)
* Fix invalid votes from the API being accepted
Fixes #12556
- Ensure `choice` is an integer instead of silently converting to 0
- Ensure `choice` corresponds to an actual choice of the poll
* Please CodeClimate
---
app/services/vote_service.rb | 2 +-
app/validators/vote_validator.rb | 8 ++++++++
config/locales/en.yml | 1 +
3 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/app/services/vote_service.rb b/app/services/vote_service.rb
index cb7dce6e8a..19e4533321 100644
--- a/app/services/vote_service.rb
+++ b/app/services/vote_service.rb
@@ -20,7 +20,7 @@ class VoteService < BaseService
ApplicationRecord.transaction do
@choices.each do |choice|
- @votes << @poll.votes.create!(account: @account, choice: choice)
+ @votes << @poll.votes.create!(account: @account, choice: Integer(choice))
end
end
else
diff --git a/app/validators/vote_validator.rb b/app/validators/vote_validator.rb
index 2e1818bdb9..b1692562d4 100644
--- a/app/validators/vote_validator.rb
+++ b/app/validators/vote_validator.rb
@@ -4,10 +4,18 @@ class VoteValidator < ActiveModel::Validator
def validate(vote)
vote.errors.add(:base, I18n.t('polls.errors.expired')) if vote.poll.expired?
+ vote.errors.add(:base, I18n.t('polls.errors.invalid_choice')) if invalid_choice?(vote)
+
if vote.poll.multiple? && vote.poll.votes.where(account: vote.account, choice: vote.choice).exists?
vote.errors.add(:base, I18n.t('polls.errors.already_voted'))
elsif !vote.poll.multiple? && vote.poll.votes.where(account: vote.account).exists?
vote.errors.add(:base, I18n.t('polls.errors.already_voted'))
end
end
+
+ private
+
+ def invalid_choice?(vote)
+ vote.choice.negative? || vote.choice >= vote.poll.options.size
+ end
end
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 62f2226e3a..d768cef332 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -922,6 +922,7 @@ en:
duration_too_long: is too far into the future
duration_too_short: is too soon
expired: The poll has already ended
+ invalid_choice: The chosen vote option does not exist
over_character_limit: cannot be longer than %{max} characters each
too_few_options: must have more than one item
too_many_options: can't contain more than %{max} items
--
GitLab