Changeset 153

Timestamp:

08/31/2006 11:56:08 (2 years ago)

Author:

why

Message:

• examples/blog.rb: novaa's security fix from #83, thainks!
  

Files:

• trunk/examples/blog.rb (modified) (3 diffs)

trunk/examples/blog.rb

@@ -63 +63 @@
         end
         def post
-            post = Post.create :title => input.post_title, :body => input.post_body,
-                               :user_id => @state.user_id
-            redirect View, post
+            unless @state.user_id.blank?
+                post = Post.create :title => input.post_title, :body => input.post_body,
+                                   :user_id => @state.user_id
+                redirect View, post
+            end
         end
     end
@@ -97 +99 @@
      
         def post
-            @post = Post.find input.post_id
-            @post.update_attributes :title => input.post_title, :body => input.post_body
-            redirect View, @post
+            unless @state.user_id.blank?
+                @post = Post.find input.post_id
+                @post.update_attributes :title => input.post_title, :body => input.post_body
+                redirect View, @post
+            end
         end
     end
@@ -220 +224 @@
           label 'Comment', :for => 'post_body'; br
           textarea :name => 'post_body' do; end; br
-          input :type => 'hidden', :name => 'post_id', :value => post.id
+          input :type => 'hidden', :name => 'post_id', :value => @post.id
           input :type => 'submit'
         end