diff options
| author | Dmitriy Zaporozhets <dzaporozhets@gitlab.com> | 2015-04-12 10:36:40 +0300 |
|---|---|---|
| committer | Dmitriy Zaporozhets <dzaporozhets@gitlab.com> | 2015-04-12 10:36:40 +0300 |
| commit | f244914402aa6b1882671824a1a98d801cd5c45c (patch) | |
| tree | 9f7ccd4be20a664102e356c6b9f3f1e6c7da4ccf /app/controllers | |
| parent | 9df14763057359a02daa3b7673cbbeb145e14420 (diff) | |
| parent | 0988be4efa8c9db6b3adcecdbad97367e837961f (diff) | |
Merge branch 'regex-start-of-string' into 'master'
Fix persistent XSS vulnerability around profile website URLs.
Fixes gitlab/gitlab-ee#268
See merge request !1761
Diffstat (limited to 'app/controllers')
| -rw-r--r-- | app/controllers/application_controller.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 80e983b5314..0521a9ef8cf 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -153,7 +153,7 @@ class ApplicationController < ActionController::Base end def method_missing(method_sym, *arguments, &block) - if method_sym.to_s =~ /^authorize_(.*)!$/ + if method_sym.to_s =~ /\Aauthorize_(.*)!\z/ authorize_project!($1.to_sym) else super |