Jeremy Daer
4efa4da809
The webhook activation controller was using account-scoped lookup instead of board-scoped lookup, allowing users to reactivate webhooks on boards they don't have access to. This was an oversight when board-scoping was added to the main webhooks controller - the activations controller was missed in that update. The fix adds the BoardScoped concern to properly restrict webhook activation to boards the user has explicit access to.
13 lines
241 B
Ruby
13 lines
241 B
Ruby
class Webhooks::ActivationsController < ApplicationController
|
|
include BoardScoped
|
|
|
|
before_action :ensure_admin
|
|
|
|
def create
|
|
webhook = @board.webhooks.find(params[:webhook_id])
|
|
webhook.activate
|
|
|
|
redirect_to webhook
|
|
end
|
|
end
|