1
44%
master: 43%

Ran 28 Jun 2026 07:10AM UTC

Files 269

Run time 6s

Badge

Embed ▾

Committed 28 Jun 2026 07:03AM UTC coverage: 43.808% (+0.8%) from 42.995%

Job # 28314588628.1

Build Type

Pull #1324

github

Committed by

lentschi

Commit Message

Fix privilege escalation via mass assignment in workgroup update (#1323)

Foodcoop::WorkgroupsController#update passed params[:workgroup] straight
to update, and the application sets permit_all_parameters = true, so any
member of the workgroup (the action only requires membership) could send
workgroup[role_admin]=true and grant their group the global admin role,
escalating from ordinary member to site administrator.

Restrict the assignment to the fields the member edit form exposes
(name, description, user_tokens) with a strong-parameters allowlist,
matching the pattern already used in home_controller#update_profile.

Pull Request Pull Request #1324: Fix privilege escalation via mass assignment in workgroup update (#1323)

Coverage Stats

2731 of 6234 relevant lines covered (43.81%)

0.65 hits per line

foodcoops / foodsoft / 28314588628 / 1
44%
master: 43%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 28314588628.1

foodcoops / foodsoft / 28314588628 / 1 44% master: 43%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 28314588628.1

foodcoops / foodsoft / 28314588628 / 1
44%
master: 43%

README BADGES
x