web-engineering/rails-example-security-solutions — pull request #5 by isery (2013-05-23 21:30:36+00:00)
Title: Security Issue with article create and edit

Any User could edit articles of other Users.

Therefore I added a method in the articles_controller which checks if the user is logged in and if it is one of the articles he created or if he is the admin.

There is a test for this in:
features/sign_up_and_login.rb

The second security Issue:

Any User could create a Article for any other User.

I removed the user_id from the form.
In the create method of the articles_controller, I check if the user is logged in and create the artice for this user_id

There is a test for this in:
requests/article_spec.rb