fix exploit with role
This commit is contained in:
		| @@ -109,12 +109,11 @@ defmodule Cannery.Accounts do | |||||||
|   @spec register_user(map()) :: {:ok, User.t()} | {:error, Changeset.t(User.new_user())} |   @spec register_user(map()) :: {:ok, User.t()} | {:error, Changeset.t(User.new_user())} | ||||||
|   def register_user(attrs) do |   def register_user(attrs) do | ||||||
|     # if no registered users, make first user an admin |     # if no registered users, make first user an admin | ||||||
|     attrs = |     role = | ||||||
|       if Repo.one!(from u in User, select: count(u.id), distinct: true) == 0, |       if Repo.one!(from u in User, select: count(u.id), distinct: true) == 0, | ||||||
|         do: attrs |> Map.put("role", "admin"), |         do: "admin", else: "user" | ||||||
|         else: attrs |  | ||||||
|  |  | ||||||
|     %User{} |> User.registration_changeset(attrs) |> Repo.insert() |     %User{} |> User.registration_changeset(attrs |> Map.put("role", role)) |> Repo.insert() | ||||||
|   end |   end | ||||||
|  |  | ||||||
|   @doc """ |   @doc """ | ||||||
|   | |||||||
		Reference in New Issue
	
	Block a user