foodcoops / foodsoft / 28314350475

43%

push

github

Fix privilege escalation via mass assignment in workgroup update (#1323)

Foodcoop::WorkgroupsController#update passed params[:workgroup] straight
to update, and the application sets permit_all_parameters = true, so any
member of the workgroup (the action only requires membership) could send
workgroup[role_admin]=true and grant their group the global admin role,
escalating from ordinary member to site administrator.

Restrict the assignment to the fields the member edit form exposes
(name, description, user_tokens) with a strong-parameters allowlist,
matching the pattern already used in home_controller#update_profile.

2 of 4 new or added lines in 1 file covered. (50.0%)

5105 of 7629 relevant lines covered (66.92%)

368.24 hits per line