From fc4711d32acb2f0a4cbcf0bfe668189f3590db49 Mon Sep 17 00:00:00 2001 From: Javyer DerDerian Date: Mon, 23 Feb 2015 15:10:52 -0300 Subject: [PATCH] fix breach in award points that allows user to award infinite points --- forum/views/users.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/forum/views/users.py b/forum/views/users.py index c6fae00..786320c 100644 --- a/forum/views/users.py +++ b/forum/views/users.py @@ -211,11 +211,16 @@ def award_points(request, id): except: raise decorators.CommandException(_("Invalid number of points to award.")) + awarding_user = get_object_or_404(User, id=request.user.pk) + + if points > awarding_user.reputation: + raise decorators.CommandException(_("Invalid number of points to award.")) + user = get_object_or_404(User, id=id) extra = dict(message=request.POST.get('message', ''), awarding_user=request.user.id, value=points) - BonusRepAction(user=request.user, extra=extra).save(data=dict(value=points, affected=user)) + BonusRepAction(user=user, extra=extra).save(data=dict(value=points, affected=user)) return {'commands': { 'update_profile_karma': [user.reputation] -- 2.39.5