fix security issue

[selectricity] / app / models / token.rb

diff --git a/app/models/token.rb b/app/models/token.rb
index 4ed9598f15cddc4888a4c32612269ad3f0f124d2..8bfecc40770854a111c3b3b10091e7f35cd85e9b 100644 (file)
--- a/app/models/token.rb
+++ b/app/models/token.rb
@@ -1,11 +1,30 @@
-class Token < ActiveRecord::Base
-  belongs_to :vote 
+# Selectricity: Voting Machinery for the Masses
+# Copyright (C) 2007, 2008 Benjamin Mako Hill <mako@atdot.cc>
+# Copyright (C) 2007 Massachusetts Institute of Technology
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public
+# License along with this program.  If not, see
+# <http://www.gnu.org/licenses/>.
 
+class Token < ActiveRecord::Base 
+  belongs_to :vote
+  
   def initialize
     super
 
     token_generator = UniqueTokenGenerator.new( 16 )
-    until not token.empty? and Token.find(:all, :conditions => [ "token = ?", token ]).empty?
+    until token and not token.empty? \
+      and Token.find(:all, :conditions => [ "token = ?", token ]).empty? and token[0..3] != "open"
       self.token = token_generator.token
     end