diff options
| author | Robert Speicher <rspeicher@gmail.com> | 2017-12-14 22:32:55 +0300 |
|---|---|---|
| committer | Robert Speicher <rspeicher@gmail.com> | 2017-12-20 00:45:08 +0300 |
| commit | 3e4b45fc216875ff25647675d92448a53a740d9b (patch) | |
| tree | 836b9459d674c2aa0c34e63ed3f4c55999729d1f /app/models/concerns/time_trackable.rb | |
| parent | 8d0ad36bcfc0ef95ee9a116604ba1516367dbb27 (diff) | |
Only include the user's ID in the time_spent command's update hash
Previously, this would include the entire User record in the update
hash, which was rendered in the response using `to_json`, erroneously
exposing every attribute of that record, including their (now removed)
private token.
Now we only include the user ID, and perform the lookup on-demand.
Diffstat (limited to 'app/models/concerns/time_trackable.rb')
| -rw-r--r-- | app/models/concerns/time_trackable.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/app/models/concerns/time_trackable.rb b/app/models/concerns/time_trackable.rb index 89fe6527647..5911b56c34c 100644 --- a/app/models/concerns/time_trackable.rb +++ b/app/models/concerns/time_trackable.rb @@ -24,7 +24,7 @@ module TimeTrackable # rubocop:disable Gitlab/ModuleWithInstanceVariables def spend_time(options) @time_spent = options[:duration] - @time_spent_user = options[:user] + @time_spent_user = User.find(options[:user_id]) @spent_at = options[:spent_at] @original_total_time_spent = nil |