foodcoops / foodsoft / 28314988615

46%

master: 43%

push

github

Fix privilege escalation via mass assignment in workgroup update (#1323) (#1324)

Foodcoop::WorkgroupsController#update passed params[:workgroup] straight
to update, and the application sets permit_all_parameters = true, so any
member of the workgroup (the action only requires membership) could send
workgroup[role_admin]=true and grant their group the global admin role,
escalating from ordinary member to site administrator.

Restrict the assignment to the fields the member edit form exposes
(name, description, user_tokens) with a strong-parameters allowlist,
matching the pattern already used in home_controller#update_profile.

Co-authored-by: tonghuaroot (童话) <tonghuaroot@gmail.com>

2 of 4 new or added lines in 1 file covered. (50.0%)

4130 of 6234 relevant lines covered (66.25%)

64.68 hits per line