From 539cd638e225c3705a0a00440a14197c0e870d96 Mon Sep 17 00:00:00 2001 From: "Stanko K.R." Date: Mon, 2 Feb 2026 16:03:50 +0100 Subject: [PATCH] Check that associations don't exist Without this you can change a belongs to to some other account's record and get access to it --- .../account/data_transfer/record_set.rb | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/app/models/account/data_transfer/record_set.rb b/app/models/account/data_transfer/record_set.rb index af112d03e..b7955932a 100644 --- a/app/models/account/data_transfer/record_set.rb +++ b/app/models/account/data_transfer/record_set.rb @@ -95,6 +95,31 @@ class Account::DataTransfer::RecordSet if model.exists?(id: data["id"]) raise IntegrityError, "#{model} record with ID #{data['id']} already exists" end + + check_associations_dont_exist(data) + end + + def check_associations_dont_exist(data) + model.reflect_on_all_associations(:belongs_to).each do |association| + foreign_key = association.foreign_key.to_s + + if associated_id = data[foreign_key] + check_association_doesnt_exist(data, association, associated_id) + end + end + end + + def check_association_doesnt_exist(data, association, associated_id) + if association.polymorphic? + type_column = association.foreign_type.to_s + associated_class = data[type_column].constantize + else + associated_class = association.klass + end + + if associated_class.exists?(id: associated_id) + raise IntegrityError, "#{model} record references existing #{association.name} (#{associated_class}) with ID #{associated_id}" + end end def skip_to(file_list, last_id)