Do not leak all records for guest users in API controllers #2145
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tvdeyen
force-pushed
the
do-not-leak-all-pages-in-api
branch
from
a3d7878
to
0b24271
Compare
tvdeyen
changed the title
tvdeyen
force-pushed
the
do-not-leak-all-pages-in-api
branch
from
89388e8
to
d3b37a0
Compare
CanCanCan does not respect any scope set before `accessible_by`. We need to make sure the additional scopes get called afterwards.
CanCanCan does not respect any scope set before `accessible_by`. We need to make sure the additional scopes get called afterwards.
Somehow with the recent fix for cancancan accessible_by the eager loading of elements contents and essences broke with "cannot eager load polymorphic association essence". Since we soft-deprecated essences anyway and this API is mostly used by the page select in the link overlay we can live with the downside
It was not working since we change some UI and was self-pending since. Fixed the underlying issues and make it more robust by using capybaras wait feature.
tvdeyen
force-pushed
the
do-not-leak-all-pages-in-api
branch
from
d3b37a0
to
f8db000
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What is this pull request for?
CanCanCan does not respect any scope set before
accessible_by.We need to make sure the additional scopes get called afterwards.
Thanks @mamhoff for finding this during working on CanCanCommunity/cancancan#717
Checklist