Médiathèque #2547
Médiathèque #2547
Conversation
Co-authored-by: Sébastien Gaya <[email protected]>
Co-authored-by: Sébastien Gaya <[email protected]>
Co-authored-by: Sébastien Gaya <[email protected]> Co-authored-by: Pierre-André Boissinot <[email protected]>
arnaudlevy
requested review from
SebouChu,
pabois,
alexisben and
Olivia206
as code owners
Co-authored-by: Sébastien Gaya <[email protected]>
|
Quand une image est envoyée en image à la une sans être croppée (on ne touche pas du tout au cropper), elle n'est pourtant pas identique à l'image envoyée dans un bloc. Résultat, il y a 2 images dans la médiathèque. @pabois possible de ne pas faire ça ? Si on ne touche pas, on ne touche pas ? |
* wip * remove data view * partly working * better * better * changes save / cancel * wip * saving works * Working facets * responsive optim * move esbuild * vue wip * i18n * cropper works! * cleaner * cloud done * medias done * changes done * components * clean * clean * remove form * remove vscode * and ignore * clean again * clean * categories * Fix #2588 * refactor * remove * locales * clean * fix * fix --------- Co-authored-by: Sébastien Gaya <[email protected]>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| end | ||
|
|
||
| def about | ||
| @about ||= about_type.constantize.find_by(university: university, id: about_id) |
Check failure
Code scanning / CodeQL
Code injection Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 3 days ago
To fix the problem, we need to ensure that the about_type value is validated and restricted to a set of known safe values before calling constantize. This can be achieved by introducing a whitelist of allowed types and checking the about_type against this list.
- Define a whitelist of allowed types.
- Validate the
about_typeagainst this whitelist before callingconstantize. - Raise an error or handle the case where
about_typeis not in the whitelist.
| @@ -64,2 +64,4 @@ | ||
|
|
||
| ALLOWED_TYPES = ['Type1', 'Type2', 'Type3'].freeze | ||
|
|
||
| def about_type | ||
| @@ -73,2 +75,5 @@ | ||
| def about | ||
| unless ALLOWED_TYPES.include?(about_type) | ||
| raise "Invalid about_type: #{about_type}" | ||
| end | ||
| @about ||= about_type.constantize.find_by(university: university, id: about_id) |
Médiathèque
Import des médias
Il y a des doutes sur Témoignages, Chiffres-clés, Fonctionnalités, mais on va attendre le besoin réel.
Réutilisation des médias
Pas de réutilisation dans les blocs, cela implique une refonte de toute l'édition des blocs.
Migrations