Ensure that boolean params in the API are parsed for truthiness (#6575)

Use Rails smart boolean cast to account for values such as "f",
"0", "false", etc. Previously, if a param was present in the request,
it would count as true.
This commit is contained in:
Eugen Rochko 2018-03-01 02:47:59 +01:00 committed by GitHub
parent 47bdb9b33b
commit fce8464077
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
7 changed files with 13 additions and 17 deletions

View file

@ -51,6 +51,10 @@ class Api::BaseController < ApplicationController
[params[:limit].to_i.abs, default_limit * 2].min [params[:limit].to_i.abs, default_limit * 2].min
end end
def truthy_param?(key)
ActiveModel::Type::Boolean.new.cast(params[key])
end
def current_resource_owner def current_resource_owner
@current_user ||= User.find(doorkeeper_token.resource_owner_id) if doorkeeper_token @current_user ||= User.find(doorkeeper_token.resource_owner_id) if doorkeeper_token
end end

View file

@ -22,8 +22,4 @@ class Api::V1::Accounts::SearchController < Api::BaseController
following: truthy_param?(:following) following: truthy_param?(:following)
) )
end end
def truthy_param?(key)
params[key] == 'true'
end
end end

View file

@ -28,9 +28,9 @@ class Api::V1::Accounts::StatusesController < Api::BaseController
def account_statuses def account_statuses
default_statuses.tap do |statuses| default_statuses.tap do |statuses|
statuses.merge!(only_media_scope) if params[:only_media] statuses.merge!(only_media_scope) if truthy_param?(:only_media)
statuses.merge!(pinned_scope) if params[:pinned] statuses.merge!(pinned_scope) if truthy_param?(:pinned)
statuses.merge!(no_replies_scope) if params[:exclude_replies] statuses.merge!(no_replies_scope) if truthy_param?(:exclude_replies)
end end
end end

View file

@ -13,9 +13,9 @@ class Api::V1::AccountsController < Api::BaseController
end end
def follow def follow
FollowService.new.call(current_user.account, @account.acct, reblogs: params[:reblogs]) FollowService.new.call(current_user.account, @account.acct, reblogs: truthy_param?(:reblogs))
options = @account.locked? ? {} : { following_map: { @account.id => { reblogs: params[:reblogs] } }, requested_map: { @account.id => false } } options = @account.locked? ? {} : { following_map: { @account.id => { reblogs: truthy_param?(:reblogs) } }, requested_map: { @account.id => false } }
render json: @account, serializer: REST::RelationshipSerializer, relationships: relationships(options) render json: @account, serializer: REST::RelationshipSerializer, relationships: relationships(options)
end end
@ -26,7 +26,7 @@ class Api::V1::AccountsController < Api::BaseController
end end
def mute def mute
MuteService.new.call(current_user.account, @account, notifications: params[:notifications]) MuteService.new.call(current_user.account, @account, notifications: truthy_param?(:notifications))
render json: @account, serializer: REST::RelationshipSerializer, relationships: relationships render json: @account, serializer: REST::RelationshipSerializer, relationships: relationships
end end

View file

@ -33,12 +33,8 @@ class Api::V1::SearchController < Api::BaseController
SearchService.new.call( SearchService.new.call(
params[:q], params[:q],
RESULTS_LIMIT, RESULTS_LIMIT,
resolving_search?, truthy_param?(:resolve),
current_account current_account
) )
end end
def resolving_search?
params[:resolve] == 'true'
end
end end

View file

@ -29,7 +29,7 @@ class Api::V1::Timelines::PublicController < Api::BaseController
end end
def public_timeline_statuses def public_timeline_statuses
Status.as_public_timeline(current_account, params[:local]) Status.as_public_timeline(current_account, truthy_param?(:local))
end end
def insert_pagination_headers def insert_pagination_headers

View file

@ -38,7 +38,7 @@ class Api::V1::Timelines::TagController < Api::BaseController
end end
def tag_timeline_statuses def tag_timeline_statuses
Status.as_tag_timeline(@tag, current_account, params[:local]) Status.as_tag_timeline(@tag, current_account, truthy_param?(:local))
end end
def insert_pagination_headers def insert_pagination_headers