Hacker News Reader

Comment by jasonshen | Hacker News Reader

That's super helpful and thank you for the very kind and welcoming way you delivered that feedback. I wish more HN comments were this nice. It takes longer to write but is more likely to be implemented.

edit - Made the update! Sorry anyone who went to the site when it was down for 20 seconds

prev edit - ans -> and

View on HN

FYI it looks like you've fixed the update controller (as per the gist), but I can still:

* See other peoples rewards (just go to /rewards/whatever-id), not that big a deal, unless you want to keep them private.

* Go to the edit form of any reward (just go to /rewards/whatever-id/edit), big-deal factor is same as above.

* Delete other peoples rewards (inspect the delete link of any reward in chrome, modify the id in the href, then click it), this is somewhat of a big deal. Sorry to whoever had reward with id 4!

PITA I know, security doesn't get easier I'm afraid :)

EDIT: updated gist to be a little more useful, though you probably worked the required code out for yourself.

Check out CanCan[1] for authorization. It's pretty simple to get started with, but provides a lot of power for controlling who can access what.

[1] https://github.com/ryanb/cancan

Seconded! Using current_user.rewards.find(...) is a good stopgap if you're not keen on going as far as using cancan.

This won't take care of the parameter whitelisting for you though.

Chrome v28.0.1500.6 dev on a MBP is rendering the page a little strange:

http://i.imgur.com/KfKFGjd.png

I assume 1, 2, and 3 are supposed to be on the same line?

Oh weird. Yeah, they are 3 divs that are supposed to take up 33% of the width until they collapse ontop of each other as the screen shrinks. That shouldn't happen - will try to reproduce and fix.

Reply on news.ycombinator.com