aaron_nad/cannery
1
0
Fork 0
forked from shibao/cannery
Code Pull Requests Activity

fix exploit with role

Browse Source
This commit is contained in:
shibao 2022-02-16 20:21:55 -05:00
parent 2f9c08b79f
commit 1f789c0a8d
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
lib/cannery/accounts.ex
View File

@ -109,12 +109,11 @@ defmodule Cannery.Accounts do
@spec register_user(map()) :: {:ok, User.t()} | {:error, Changeset.t(User.new_user())} @spec register_user(map()) :: {:ok, User.t()} | {:error, Changeset.t(User.new_user())}
def register_user(attrs) do def register_user(attrs) do
# if no registered users, make first user an admin # if no registered users, make first user an admin
attrs = role =
if Repo.one!(from u in User, select: count(u.id), distinct: true) == 0, if Repo.one!(from u in User, select: count(u.id), distinct: true) == 0,
do: attrs |> Map.put("role", "admin"), do: "admin", else: "user"
else: attrs
%User{} |> User.registration_changeset(attrs) |> Repo.insert() %User{} |> User.registration_changeset(attrs |> Map.put("role", role)) |> Repo.insert()
end end
@doc """ @doc """