search

automch-code / google-scraping

0 stars 0 forks source link

[Bug] Some API endpoints are not properly authorized #23

Open olivierobert opened 1 year ago

olivierobert commented 1 year ago

Issue

The endpoint v1/keywords/:id can return any keyword, even those not belonging to the current user:

https://github.com/automch-code/google-scraping/blob/3a18502d9f4a97c31916a0e90857c9d6489412b9/backend/app/controllers/api/v1/keywords_controller.rb#L21-L24

The related tests do not catch authorization issues.

Expected

All resources must be consistently (as done in the index) method to ensure users can only access data they own.

automch-code commented 1 year ago

Hello, Mr. Olivier I've already fixed the issue about find_keyword scope by current_user already. You can review my pull request at here.

olivierobert commented 1 year ago

All good to apply the change. I have added some suggestions for you as resources. Let's keep the changes simple.

🙈 You can call me Olivier. Adding Mr.s makes me feel older than I am.

automch-code commented 1 year ago

OK Olivier. I dont know how to call in polite way i have to improve my english skill. 😆