schneems/wicked — pull request #95 by ahorner (2013-10-09 04:12:38+00:00)
Title: Raise exceptions on invalid step requests

The current implementation accepts the params[:id] value without
question, which leads to the potential for vulnerabilities like #94,
since it allows potential attackers/clever users to bypass the step
definitions established in the controller.

This performs a strict check of the requested step against the steps
defined for the Wicked::Wizard controller, and raises an exception if
no matching step can be identified. For the sake of friendly error-
handling (e.g., rendering 404 pages appropriately), special runtime
error classes have been introduced.

I had to bump the Ruby version in the .rvmrc file, since
activesupport 4.0.0 is not compatible with 1.9.2.