]> git.openstreetmap.org Git - osqa.git/commitdiff
fix breach in award points that allows user to award infinite points
authorJavyer DerDerian <javierder@gmail.com>
Mon, 23 Feb 2015 18:10:52 +0000 (15:10 -0300)
committerJavyer DerDerian <javierder@gmail.com>
Mon, 23 Feb 2015 18:10:52 +0000 (15:10 -0300)
forum/views/users.py

index c6fae00e31a08d96615d6ed828c73fe239d16272..786320ca9608b08414e1eef47ec12642e5331316 100644 (file)
@@ -211,11 +211,16 @@ def award_points(request, id):
     except:
         raise decorators.CommandException(_("Invalid number of points to award."))
 
     except:
         raise decorators.CommandException(_("Invalid number of points to award."))
 
+    awarding_user = get_object_or_404(User, id=request.user.pk)
+
+    if points > awarding_user.reputation:
+        raise decorators.CommandException(_("Invalid number of points to award."))
+
     user = get_object_or_404(User, id=id)
 
     extra = dict(message=request.POST.get('message', ''), awarding_user=request.user.id, value=points)
 
     user = get_object_or_404(User, id=id)
 
     extra = dict(message=request.POST.get('message', ''), awarding_user=request.user.id, value=points)
 
-    BonusRepAction(user=request.user, extra=extra).save(data=dict(value=points, affected=user))
+    BonusRepAction(user=user, extra=extra).save(data=dict(value=points, affected=user))
 
     return {'commands': {
             'update_profile_karma': [user.reputation]
 
     return {'commands': {
             'update_profile_karma': [user.reputation]