Merge pull request #37 from gencat/fix/polymorphic_errors

Fix polymorphic error with link_to
gencat · May 10, 2021 · 1ac132b · 1ac132b
2 parents 5774550 + 8070592
commit 1ac132b
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 3 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,8 @@ Following Semantic Versioning 2.
 - Allow to perform all actions in Conferences (decidim-conferences).
 - Allow to perform some actions in Participants (decidim-participants).
 - Increase minimum Decidim version to v0.23
+- Fix polymorphic error in redirect or link_to. In order to do that,
+  strings are changed by symbols. [CVE-2021-22885](https://github.com/advisories/GHSA-hjg4-8q5f-x6fm)
 
 ## Version 0.1.0 (MINOR)
 - Increase minimum Decidim version to v0.22

diff --git a/app/views/decidim/admin/users/index.html.erb b/app/views/decidim/admin/users/index.html.erb
@@ -77,7 +77,7 @@ function changeFilter(el) {
     <h2 class="card-title">
       <%= t "decidim.admin.titles.users" %>
       <% if allowed_to? :create, :admin_user %>
-        <%= link_to t("actions.new", scope: "decidim.admin", name: t("models.user.name", scope: "decidim.admin")), ["new", "user"], class: "button tiny button--title" %>
+        <%= link_to t("actions.new", scope: "decidim.admin", name: t("models.user.name", scope: "decidim.admin")), [:new, :user], class: "button tiny button--title" %>
       <% end %>
     </h2>
   </div>
@@ -142,7 +142,7 @@ function changeFilter(el) {
                   <% end %>
 
                   <% if allowed_to?(:invite, :admin_user, user: user) && user.invited_to_sign_up? %>
-                    <%= icon_link_to "reload", ["resend_invitation", user], t("actions.resend_invitation", scope: "decidim.admin"), class: "resend-invitation", method: :post %>
+                    <%= icon_link_to "reload", [:resend_invitation, user], t("actions.resend_invitation", scope: "decidim.admin"), class: "resend-invitation", method: :post %>
                   <% end %>
 
                   <% if allowed_to? :destroy, :admin_user, user: user %>

diff --git a/app/views/decidim/participatory_processes/admin/participatory_processes/index.html.erb b/app/views/decidim/participatory_processes/admin/participatory_processes/index.html.erb
@@ -7,7 +7,7 @@
 
       <% if allowed_to? :create, :process %>
         <%= link_to t("actions.new_process", scope: "decidim.admin"),
-                    ["new", "participatory_process"],
+                    [:new, :participatory_process],
                     class: "button tiny button--title" %>
       <% end %>