fix security issue

[selectricity-live] / app / controllers / voter_controller.rb

diff --git a/app/controllers/voter_controller.rb b/app/controllers/voter_controller.rb
index 5d729a6752800f7f799666b3c45d3bc38ceca375..a550f676cc3d2ced5c851eef5c4f4c8632363159 100644 (file)
--- a/app/controllers/voter_controller.rb
+++ b/app/controllers/voter_controller.rb
@@ -97,16 +97,18 @@ class VoterController < ApplicationController
   end
 
   def confirm
-    @voter.vote.confirm!
-
-    if @voter.election.embeddable? and params[:embed] == "true" \
-      and @voter.election.early_results?
-      redirect_to :action => :results, :id => @password, :embed => 'true'
-    elsif not(@voter.election.verifiable) \
-      and @voter.election.kiosk and params[:kiosk] == "true"
-      redirect_to :action => "kiosk_ready", :id => @password, :kiosk => true
+    if @voter.vote.confirm!
+      if @voter.election.embeddable? and params[:embed] == "true" \
+        and @voter.election.early_results?
+        redirect_to :action => :results, :id => @password, :embed => 'true'
+      elsif not(@voter.election.verifiable) \
+        and @voter.election.kiosk and params[:kiosk] == "true"
+        redirect_to :action => "kiosk_ready", :id => @password, :kiosk => true
+      else
+        render :action => 'thanks'
+      end
     else
-      render :action => 'thanks'
+      redirect_to :action => 'index'
     end
   end
   
@@ -123,8 +125,9 @@ class VoterController < ApplicationController
   end
   
   def results
-    if @voter.election.early_results? \
-       or @voter.election.enddate < Time.now
+    if authenticate and
+      (@voter.election.early_results? \
+       or @voter.election.enddate < Time.now)
       
       @election = @voter.election
       @sidebar_content = \
@@ -195,7 +198,7 @@ class VoterController < ApplicationController
 
         # when (a) there is no voter or (b) when there is a voter but
         # it's kiosk mode on the right page, rewrite with a blank voter
-        if not(@voter) \
+        if ((not @voter) and  (election.enddate < Time.now)) \
           or (params[:action] == 'kiosk_ready' and election.kiosk)
           @voter = OpenVoter.new unless @voter
         end