jpalmieri/blocitoff — pull request #10 by jpalmieri (2014-12-10 05:57:26+00:00)
Title: Secure todo deletions

Regarding your suggestions from pull request https://github.com/jpalmieri/blocitoff/pull/9

>Looks like there's a vulnerability here where a logged-in user could potentially delete another user's todos by trying out different ids in the requested URL.

>To check if this vulnerability exists, and before fixing it if it does:

>Create a new branch (e.g. secure-todo-deletions)
>Write a controller spec that exposes the vulnerability with a failing spec. As this attack isn't really possible >through clicking things in the UI, and so hard-to-test in a feature spec, a controller spec where we can control and tamper with the request params, as an attacker could, is a better place to test for this.
>If the problem exists, then fix it, and ensure the new spec passes

I think I've fixed the vulnerability. Let me know if this looks good to you. Thanks!