maverick/docbrown
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
docbrown/app/controllers
History
Jeremy Friesen 4509e81dd5
Ensuring the same policies for analytics (#16997) 
Prior to this commit the following situation existed:

> The path /dashboard/analytics/org/:id requires user
> authentication (e.g. signed in). However, it does not enforce
> authorization. Anyone can see this page. The page, however, uses
> javascript to populate the data. So no information, aside from the org
> name associated with the :id leaks out. The javascript API end point
> enforces organization membership.
>
> I would expect that the authorization in the HTML rendering would be
> the same as the javascript API end point.

This commit ensures that the dashboards#analytics end point uses the
same policy logic as the API analytics end points.  Further, it keeps
folks who aren't org members out of the base HTML page for other orgs.

Closes forem/forem/#16985
2022-03-25 14:57:01 -04:00
..
admin Adding :internal auditing for admin/spaces#update (#17010) 2022-03-25 14:25:13 -04:00
api/v0 Ensuring the same policies for analytics (#16997) 2022-03-25 14:57:01 -04:00
concerns More listings refactoring (#16343) 2022-02-23 13:44:30 +07:00
incoming_webhooks Use new UserSetting and UserNotificationSettings and Ignore Related User Table Fields (#14121) 2021-07-08 09:31:34 -05:00
notifications Rubocop: fix additional violations in todo file (#9218) 2020-07-09 10:25:44 -04:00
stories Improve the UX of the SMTP Section (#16223) 2022-02-15 18:40:14 +02:00
users A suspended user returns 403 instead of 500 (#16408) 2022-02-04 09:42:23 -05:00
api_secrets_controller.rb Add a contact email address to the /admin/customization/config (#16497) 2022-02-15 17:37:08 +02:00
application_controller.rb Adding inline documentation (#16955) 2022-03-21 17:18:06 -04:00
application_metal_controller.rb Add ApplicationMetalController to relevant controllers (#4937) 2019-11-26 16:29:07 -05:00
article_approvals_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
articles_controller.rb Fix RSS feed validity issue (#16418) (#16517) 2022-02-22 09:22:05 -06:00
async_info_controller.rb Fix NoMethodError on User#email (#16591) 2022-02-15 10:50:10 -05:00
badges_controller.rb Add badges index page. (#4236) 2019-10-06 17:34:52 -04:00
collections_controller.rb Series count to only include non empty series (#16130) 2022-01-18 10:22:34 +07:00
comments_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
confirmations_controller.rb Add a contact email address to the /admin/customization/config (#16497) 2022-02-15 17:37:08 +02:00
credits_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
dashboards_controller.rb Ensuring the same policies for analytics (#16997) 2022-03-25 14:57:01 -04:00
deep_links_controller.rb Add exclusion to AASA supported paths (#14593) 2021-08-26 10:17:39 -06:00
devices_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
discussion_locks_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
display_ad_events_controller.rb Extracting constants and tidying tests (#15946) 2022-01-05 09:19:39 -05:00
email_authorizations_controller.rb Standardize ActiveRecord order clauses (#9395) 2020-07-20 10:00:51 -04:00
email_subscriptions_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
feedback_messages_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
followings_controller.rb Rubocop: move dot in multi-line calls to leading position (#9262) 2020-07-16 15:51:11 +02:00
follows_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
ga_events_controller.rb Skip google analytics when ga_tracking_id is nil (#15967) 2022-01-06 12:21:07 -05:00
github_repos_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
html_variant_successes_controller.rb Move HtmlVariantSuccessesCreate from job to inline (#5879) [deploy] 2020-02-04 10:24:39 -08:00
html_variant_trials_controller.rb Move HtmlVariantTrial#create inline (#5901) [deploy] 2020-02-04 17:29:46 -08:00
image_uploads_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
invitations_controller.rb Part One: Fix Users Stuck in a "Created" but "Unregistered" State (#10882) 2020-10-19 16:51:31 -04:00
liquid_embeds_controller.rb Move work from template to controller (#16092) 2022-01-18 11:21:25 -05:00
liquid_tags_controller.rb Remove redundant freeze calls (#14596) 2021-08-26 10:01:08 -04:00
listings_controller.rb More listings refactoring (#16343) 2022-02-23 13:44:30 +07:00
moderations_controller.rb Refactoring questions asked of user (#15762) 2021-12-21 12:45:12 -05:00
notification_subscriptions_controller.rb Rename unidiomatic methods (#13328) 2021-04-09 10:59:56 -05:00
notifications_controller.rb Removing unused instance variable (#16826) 2022-03-08 13:59:08 -05:00
omniauth_callbacks_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
onboardings_controller.rb Cache onboarding at edge (#6966) 2020-03-31 16:12:14 +02:00
open_search_controller.rb [deploy] Remove need for ENV vars during asset precompile (#10349) 2020-09-16 13:57:05 -04:00
organizations_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
page_views_controller.rb Ensuring we don't track views of author or unpublished (#16143) 2022-01-18 11:23:18 -05:00
pages_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
passwords_controller.rb Add a notification on password reset (#14968) 2021-10-07 14:48:01 -04:00
podcast_episodes_controller.rb Fix and clean up podcast pages (#15004) 2021-10-15 17:38:57 -04:00
podcasts_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
poll_skips_controller.rb Use constants for Permitted params in controller (#14895) 2021-10-05 09:00:14 -04:00
poll_votes_controller.rb Use constants for Permitted params in controller (#14895) 2021-10-05 09:00:14 -04:00
pro_accounts_controller.rb Add basic pro accounts lander test (#3433) 2019-07-09 22:10:50 -04:00
profile_field_groups_controller.rb Add ProfileFieldGroupsController to API (#10124) 2020-09-03 10:12:53 +07:00
profile_pins_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
profile_preview_cards_controller.rb Add JSON representation of Profile Preview Card info (#14296) 2021-07-21 16:23:54 +01:00
profiles_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
rating_votes_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
reactions_controller.rb Don't try to create invalid RatingVote (#14706) 2021-09-14 09:41:59 +07:00
reading_list_items_controller.rb [deploy] Fix Reading List Counter Without last_reacted_at Default (#10933) 2020-10-19 13:26:19 -05:00
registrations_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
response_templates_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
search_controller.rb Added "Tags" category to search results (#16265) 2022-01-26 20:51:15 +03:00
service_worker_controller.rb Revert "Revert "Removed service worker (#12974)" (#13014)" (#13015) 2021-03-17 10:57:56 -04:00
sidebars_controller.rb Refactoring to consolidate logic (#15851) 2021-12-29 11:08:04 -05:00
sitemaps_controller.rb Spelling (#15702) 2021-12-07 06:59:10 -07:00
social_previews_controller.rb Render social previews for tags with one of the two custom colors set (#16557) 2022-02-15 09:56:57 -06:00
stories_controller.rb Redirect appended /moderate and /admin to the same page (admin member view) (#16779) 2022-03-03 19:40:03 -05:00
stripe_active_cards_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
tag_adjustments_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
tags_controller.rb Add ability to bulk search tags by name or id (#16671) 2022-02-24 12:34:50 -05:00
user_blocks_controller.rb ✂✂✂ Remove Connect (#14734) 2021-11-18 08:21:00 -06:00
user_subscriptions_controller.rb UserSubscription backend refactor (#9060) 2020-07-02 12:08:37 -04:00
users_controller.rb Add a contact email address to the /admin/customization/config (#16497) 2022-02-15 17:37:08 +02:00
video_states_controller.rb app/controllers & decorators i18n (#16126) 2022-02-03 13:35:56 -05:00
videos_controller.rb Removing before_action in favor of explicity call (#16777) 2022-03-04 11:08:53 -05:00