Security Fixes for BeltsController - Githubissues

hex337 / quantum-attendance

An attendance program for Quantum Martial Arts

MIT License

3 stars 2 forks source link

Security Fixes for BeltsController #72

Closed mlamina closed 8 months ago

mlamina commented 8 months ago

This PR addresses several security vulnerabilities found in belts_controller.rb, specifically:

Avoid Redirect: Sanitized user input before using it for redirects to prevent spoofing and unauthorized access.
Unscoped Find: Scoped find(...) calls to the current user to prevent Insecure Direct Object Reference (IDOR) behavior and unauthorized record access.

These changes ensure the security and integrity of our application by preventing potential exploits.