rwarbelow/the_swot_bot — pull request #126 by pushcx (2013-08-24 00:01:08+00:00)
Title: Fix security problem that lets Guardians look up Students who aren't theirs

This controller was authenticating users but not authorizing them. Via
Guardians::BaseController, this controller required the user to be a guardian
(authenticating them as a real user), but didn't check that they have a
relationship to the student (authorizing them to perform this action).

Instead of looking up the student by id directly, this changes it to look up
the student through Guardian's relationship to Student. This find() will only
search the guardian's students.

There are similar problems all over this codebase. I wondered about it after
your presentation this morning mentioned the importance of security. Using
relationships is the easiest way to scope searches and prevent people from
looking up others' records. Use this spec as an example to test your other
controllers.