From d386d89179ccc2b86894a8639b658f4ede24c5f6 Mon Sep 17 00:00:00 2001 From: ThibG Date: Sun, 12 Jan 2020 14:17:03 +0100 Subject: Fix invalid votes from the API being accepted (#12601) * Fix invalid votes from the API being accepted Fixes #12556 - Ensure `choice` is an integer instead of silently converting to 0 - Ensure `choice` corresponds to an actual choice of the poll * Please CodeClimate --- app/validators/vote_validator.rb | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'app/validators') diff --git a/app/validators/vote_validator.rb b/app/validators/vote_validator.rb index 2e1818bdb..b1692562d 100644 --- a/app/validators/vote_validator.rb +++ b/app/validators/vote_validator.rb @@ -4,10 +4,18 @@ class VoteValidator < ActiveModel::Validator def validate(vote) vote.errors.add(:base, I18n.t('polls.errors.expired')) if vote.poll.expired? + vote.errors.add(:base, I18n.t('polls.errors.invalid_choice')) if invalid_choice?(vote) + if vote.poll.multiple? && vote.poll.votes.where(account: vote.account, choice: vote.choice).exists? vote.errors.add(:base, I18n.t('polls.errors.already_voted')) elsif !vote.poll.multiple? && vote.poll.votes.where(account: vote.account).exists? vote.errors.add(:base, I18n.t('polls.errors.already_voted')) end end + + private + + def invalid_choice?(vote) + vote.choice.negative? || vote.choice >= vote.poll.options.size + end end -- cgit