From fce8464077dfca64c3bc9a52b7bcde50c9ac555e Mon Sep 17 00:00:00 2001
From: Eugen Rochko <eugen@zeonfederated.com>
Date: Thu, 1 Mar 2018 02:47:59 +0100
Subject: [PATCH] Ensure that boolean params in the API are parsed for
truthiness (#6575)
Use Rails smart boolean cast to account for values such as "f",
"0", "false", etc. Previously, if a param was present in the request,
it would count as true.
---
app/controllers/api/base_controller.rb | 4 ++++
app/controllers/api/v1/accounts/search_controller.rb | 4 ----
app/controllers/api/v1/accounts/statuses_controller.rb | 6 +++---
app/controllers/api/v1/accounts_controller.rb | 6 +++---
app/controllers/api/v1/search_controller.rb | 6 +-----
app/controllers/api/v1/timelines/public_controller.rb | 2 +-
app/controllers/api/v1/timelines/tag_controller.rb | 2 +-
7 files changed, 13 insertions(+), 17 deletions(-)
diff --git a/app/controllers/api/base_controller.rb b/app/controllers/api/base_controller.rb
index 52e68ab35f..7b5168b314 100644
--- a/app/controllers/api/base_controller.rb
+++ b/app/controllers/api/base_controller.rb
@@ -51,6 +51,10 @@ class Api::BaseController < ApplicationController
[params[:limit].to_i.abs, default_limit * 2].min
end
+ def truthy_param?(key)
+ ActiveModel::Type::Boolean.new.cast(params[key])
+ end
+
def current_resource_owner
@current_user ||= User.find(doorkeeper_token.resource_owner_id) if doorkeeper_token
end
diff --git a/app/controllers/api/v1/accounts/search_controller.rb b/app/controllers/api/v1/accounts/search_controller.rb
index 11e647c3cb..7649da4339 100644
--- a/app/controllers/api/v1/accounts/search_controller.rb
+++ b/app/controllers/api/v1/accounts/search_controller.rb
@@ -22,8 +22,4 @@ class Api::V1::Accounts::SearchController < Api::BaseController
following: truthy_param?(:following)
)
end
-
- def truthy_param?(key)
- params[key] == 'true'
- end
end
diff --git a/app/controllers/api/v1/accounts/statuses_controller.rb b/app/controllers/api/v1/accounts/statuses_controller.rb
index 095f6937b0..7261ccd247 100644
--- a/app/controllers/api/v1/accounts/statuses_controller.rb
+++ b/app/controllers/api/v1/accounts/statuses_controller.rb
@@ -28,9 +28,9 @@ class Api::V1::Accounts::StatusesController < Api::BaseController
def account_statuses
default_statuses.tap do |statuses|
- statuses.merge!(only_media_scope) if params[:only_media]
- statuses.merge!(pinned_scope) if params[:pinned]
- statuses.merge!(no_replies_scope) if params[:exclude_replies]
+ statuses.merge!(only_media_scope) if truthy_param?(:only_media)
+ statuses.merge!(pinned_scope) if truthy_param?(:pinned)
+ statuses.merge!(no_replies_scope) if truthy_param?(:exclude_replies)
end
end
diff --git a/app/controllers/api/v1/accounts_controller.rb b/app/controllers/api/v1/accounts_controller.rb
index 4e73e9e8b5..d643259441 100644
--- a/app/controllers/api/v1/accounts_controller.rb
+++ b/app/controllers/api/v1/accounts_controller.rb
@@ -13,9 +13,9 @@ class Api::V1::AccountsController < Api::BaseController
end
def follow
- FollowService.new.call(current_user.account, @account.acct, reblogs: params[:reblogs])
+ FollowService.new.call(current_user.account, @account.acct, reblogs: truthy_param?(:reblogs))
- options = @account.locked? ? {} : { following_map: { @account.id => { reblogs: params[:reblogs] } }, requested_map: { @account.id => false } }
+ options = @account.locked? ? {} : { following_map: { @account.id => { reblogs: truthy_param?(:reblogs) } }, requested_map: { @account.id => false } }
render json: @account, serializer: REST::RelationshipSerializer, relationships: relationships(options)
end
@@ -26,7 +26,7 @@ class Api::V1::AccountsController < Api::BaseController
end
def mute
- MuteService.new.call(current_user.account, @account, notifications: params[:notifications])
+ MuteService.new.call(current_user.account, @account, notifications: truthy_param?(:notifications))
render json: @account, serializer: REST::RelationshipSerializer, relationships: relationships
end
diff --git a/app/controllers/api/v1/search_controller.rb b/app/controllers/api/v1/search_controller.rb
index 997eed6e2c..05754d0f24 100644
--- a/app/controllers/api/v1/search_controller.rb
+++ b/app/controllers/api/v1/search_controller.rb
@@ -33,12 +33,8 @@ class Api::V1::SearchController < Api::BaseController
SearchService.new.call(
params[:q],
RESULTS_LIMIT,
- resolving_search?,
+ truthy_param?(:resolve),
current_account
)
end
-
- def resolving_search?
- params[:resolve] == 'true'
- end
end
diff --git a/app/controllers/api/v1/timelines/public_controller.rb b/app/controllers/api/v1/timelines/public_controller.rb
index 49887778e0..98d3ae1577 100644
--- a/app/controllers/api/v1/timelines/public_controller.rb
+++ b/app/controllers/api/v1/timelines/public_controller.rb
@@ -29,7 +29,7 @@ class Api::V1::Timelines::PublicController < Api::BaseController
end
def public_timeline_statuses
- Status.as_public_timeline(current_account, params[:local])
+ Status.as_public_timeline(current_account, truthy_param?(:local))
end
def insert_pagination_headers
diff --git a/app/controllers/api/v1/timelines/tag_controller.rb b/app/controllers/api/v1/timelines/tag_controller.rb
index 08db04a39d..9b46c7bb3d 100644
--- a/app/controllers/api/v1/timelines/tag_controller.rb
+++ b/app/controllers/api/v1/timelines/tag_controller.rb
@@ -38,7 +38,7 @@ class Api::V1::Timelines::TagController < Api::BaseController
end
def tag_timeline_statuses
- Status.as_tag_timeline(@tag, current_account, params[:local])
+ Status.as_tag_timeline(@tag, current_account, truthy_param?(:local))
end
def insert_pagination_headers
--
GitLab