diff options
| author | ThibG <thib@sitedethib.com> | 2020-01-12 14:17:03 +0100 |
|---|---|---|
| committer | Eugen Rochko <eugen@zeonfederated.com> | 2020-01-12 14:17:03 +0100 |
| commit | d386d89179ccc2b86894a8639b658f4ede24c5f6 (patch) | |
| tree | 689b34cf728a7a0754a9834f2d49173548573be5 | |
| parent | 7da54001fe21d1fd10ede5ac78e5c76f25afc08e (diff) | |
Fix invalid votes from the API being accepted (#12601)
* Fix invalid votes from the API being accepted Fixes #12556 - Ensure `choice` is an integer instead of silently converting to 0 - Ensure `choice` corresponds to an actual choice of the poll * Please CodeClimate
| -rw-r--r-- | app/services/vote_service.rb | 2 | ||||
| -rw-r--r-- | app/validators/vote_validator.rb | 8 | ||||
| -rw-r--r-- | config/locales/en.yml | 1 |
3 files changed, 10 insertions, 1 deletions
diff --git a/app/services/vote_service.rb b/app/services/vote_service.rb index cb7dce6e8..19e453332 100644 --- a/app/services/vote_service.rb +++ b/app/services/vote_service.rb @@ -20,7 +20,7 @@ class VoteService < BaseService ApplicationRecord.transaction do @choices.each do |choice| - @votes << @poll.votes.create!(account: @account, choice: choice) + @votes << @poll.votes.create!(account: @account, choice: Integer(choice)) end end else diff --git a/app/validators/vote_validator.rb b/app/validators/vote_validator.rb index 2e1818bdb..b1692562d 100644 --- a/app/validators/vote_validator.rb +++ b/app/validators/vote_validator.rb @@ -4,10 +4,18 @@ class VoteValidator < ActiveModel::Validator def validate(vote) vote.errors.add(:base, I18n.t('polls.errors.expired')) if vote.poll.expired? + vote.errors.add(:base, I18n.t('polls.errors.invalid_choice')) if invalid_choice?(vote) + if vote.poll.multiple? && vote.poll.votes.where(account: vote.account, choice: vote.choice).exists? vote.errors.add(:base, I18n.t('polls.errors.already_voted')) elsif !vote.poll.multiple? && vote.poll.votes.where(account: vote.account).exists? vote.errors.add(:base, I18n.t('polls.errors.already_voted')) end end + + private + + def invalid_choice?(vote) + vote.choice.negative? || vote.choice >= vote.poll.options.size + end end diff --git a/config/locales/en.yml b/config/locales/en.yml index 62f2226e3..d768cef33 100644 --- a/config/locales/en.yml +++ b/config/locales/en.yml @@ -922,6 +922,7 @@ en: duration_too_long: is too far into the future duration_too_short: is too soon expired: The poll has already ended + invalid_choice: The chosen vote option does not exist over_character_limit: cannot be longer than %{max} characters each too_few_options: must have more than one item too_many_options: can't contain more than %{max} items |