diff options
| author | Christopher Allan Webber <cwebber@dustycloud.org> | 2013-03-04 10:12:48 -0600 |
|---|---|---|
| committer | Christopher Allan Webber <cwebber@dustycloud.org> | 2013-03-04 10:12:48 -0600 |
| commit | 17e4679ddc4b6ee6d2be5a5e55ba9d314e5a1a42 (patch) | |
| tree | 4e0c70902d58da2b29ce31955d7d063f72ddbe5c /mediagoblin/db/migration_tools.py | |
| parent | 3ff4f75203295550a823e3651ead3340a690b7de (diff) | |
| download | mediagoblin-17e4679ddc4b6ee6d2be5a5e55ba9d314e5a1a42.tar.lz mediagoblin-17e4679ddc4b6ee6d2be5a5e55ba9d314e5a1a42.tar.xz mediagoblin-17e4679ddc4b6ee6d2be5a5e55ba9d314e5a1a42.zip | |
Three fixes to collection adding view, one of them a serious security bug
- Don't let people who aren't the authors of a collection from adding
things to it (handled by forcing the user check in the query)
- request url in case invalid collection selected fixed
- collection_item.author doesn't yet exist; removing the selection
(we might want multiple people to be able to edit a collection in
the future but that future does not yet exist; as Elrond said,
remove this "false hope")
Thanks to Elrond to pointing out these issues.
And thanks to David Kindler for sponsoring this commit!
Diffstat (limited to 'mediagoblin/db/migration_tools.py')
0 files changed, 0 insertions, 0 deletions