From 08eaa40b9cbb3b838cf99e6ec229c31526cf8707 Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Wed, 5 Aug 2026 12:30:04 +0100 Subject: [PATCH] Validate legale parameter to accounts/terms#show Reported-by: Turqay Memmedli --- app/controllers/accounts/terms_controller.rb | 2 ++ .../accounts/terms_controller_test.rb | 17 +++++++++++++++++ 2 files changed, 19 insertions(+) diff --git a/app/controllers/accounts/terms_controller.rb b/app/controllers/accounts/terms_controller.rb index 2a2961a99..0f1c25627 100644 --- a/app/controllers/accounts/terms_controller.rb +++ b/app/controllers/accounts/terms_controller.rb @@ -13,6 +13,8 @@ module Accounts authorize_resource :class => :account_terms def show + param! :legale, String, :format => /^[A-Z]+$/ + @legale = params[:legale] || OSM.ip_to_country(request.remote_ip) || Settings.default_legale @text = OSM.legal_text_for_country(@legale) @text_legale = @legale diff --git a/test/controllers/accounts/terms_controller_test.rb b/test/controllers/accounts/terms_controller_test.rb index 9bef0d53a..b5e7f1f1b 100644 --- a/test/controllers/accounts/terms_controller_test.rb +++ b/test/controllers/accounts/terms_controller_test.rb @@ -50,6 +50,23 @@ module Accounts assert_response :success end + def test_show_in_french + user = create(:user, :terms_seen => true, :terms_agreed => Date.yesterday) + session_for(user) + + get account_terms_path(:legale => "FR") + assert_response :success + end + + def test_show_with_bogus_legale + user = create(:user, :terms_seen => true, :terms_agreed => Date.yesterday) + session_for(user) + + get account_terms_path(:legale => "..") + assert_response :redirect + assert_redirected_to :controller => "/errors", :action => :bad_request + end + def test_update_decline_by_not_checking_the_boxes freeze_time do user = create(:user, :terms_seen => false, :terms_agreed => nil, :tou_agreed => nil) -- 2.47.3