3scale/issues-test — Issue #525: Security issue in invoice controller (TO BE DONE BEFORE MERGE OR MULTITENANT)
Author: HakubJozak
Created: 2012-02-10 18:05:06+00:00
State: open

def find_invoice_source
@invoice_source = if params[:account_id]
# current_account.buyer_accounts.find(params[:account_id]).invoices
Invoice.by_buyer(find_buyer)
else
Invoice.by_provider(current_account)
end
end

This doesn't take into consideration if they're your own buyers.

Tasks

https://www.pivotaltracker.com/story/show/19240209