redpen-rails 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5e5043df8722fefb8032852b2ff807ecd9b8f70bd8009b7453d2588892868845
-  data.tar.gz: 98582301d64109683fb44ae42f3b24a53c50ebbef3cbdcaeb214fd5adf22c693
+  metadata.gz: 28bef384bf0816760a2312e367eb019fe05615fb2fc3dc214785f354bc8608e3
+  data.tar.gz: b9ac0d19df074e91d0a494c1eb3d23113e11a3023bc842e6a49d944b435442e9
 SHA512:
-  metadata.gz: 3f2a440ce69a5081ee8dc0ccf7112ad6a5bfe0a4dd8f741edfe4662284c88a663aff289a69e0011990b850fbb6e43955ea75fda6f350cbb44136ca7de8401f5f
-  data.tar.gz: 1f8f0346aa294dcc84b0824827be7f03bd7c9334978645b111592d810f29c3a7bf25d8ecf65b4d1ff888c2d31981d597d9f6901416e326ee496859d0fba90f89
+  metadata.gz: 3c6c9601879d15fd5b46636bb8a1285698666fae5a363f9cbfd7b0566fc2b0866de0a4757d82c863fc0aa5003bed64f2f318bcf980dc49006dd4c84e8ddf32f1
+  data.tar.gz: 6987d5b87a81e471c58fd0d83a7100e0ed33c5a59556dcbfa97a5d8b55d1f27227f4465b3d37a09e8f326d66b458a6df4185c26e770567d7f0c5247051af646f

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.1.2 — 2026-09-18
+
+**Security.** `NotesController` asked `Redpen.annotatable` about `params[:path]` whenever the query named one, while `create` wrote the note to `note[path]` and `destroy` removed whatever note the id named. A signed-in author allowed on any one page could therefore add a note to, or delete a note from, a page they may not pen, by naming their own page in the query. The gate now asks about the page the request actually touches: the query's path for the index, the note's own path for create and destroy. Resolving and reopening were never affected. Found reviewing Curated Connections' landing pages.
+
 ## 0.1.1 — 2026-09-16
 
 Helpers register in `to_prepare` instead of an engine initializer. A host that loads `ActionController::Base` during boot (Curated Connections requires a lib from `application.rb` that does) fired the `on_load` hook before the autoloader existed, and `Redpen::RailHelper` failed to resolve. Found on the first day of the second host.

data/app/controllers/redpen/notes_controller.rb

@@ -26,8 +26,15 @@ module Redpen
         @note ||= Note.find(params[:id])
       end
 
+      # The page the gate is asked about is the page this request reads or writes: the
+      # query's path for the index, the note's own path for create and destroy. Taking it
+      # from anywhere else would let a request pass the gate for one page and land on another.
       def path
-        @path ||= params[:path].presence || params.dig(:note, :path).presence || note.path
+        @path ||= case action_name
+          when "index"  then params[:path]
+          when "create" then note_params[:path]
+          else note.path
+        end
       end
 
       def note_params

data/lib/redpen/version.rb

@@ -1,3 +1,3 @@
 module Redpen
-  VERSION = "0.1.1"
+  VERSION = "0.1.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: redpen-rails
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Nityesh Agarwal