Commit fb5db82

mo <mo.khan@gmail.com>
2019-06-15 20:44:37
remove low risk RCE
1 parent c171cd9
Changed files (1)
app
views
app/views/my/audits/_audit.html.erb
@@ -8,7 +8,7 @@
     <div class="media-content">
       <div class="content">
         <p>
-          <strong><%= audit.auditable_type.constantize.model_name.human %></strong> <small><%= t(audit.action) %></small> <small><%= local_time_ago(audit.created_at) %></small>
+          <strong><%= t("activerecord.models.#{audit.auditable_type.underscore}") %></strong> <small><%= t(audit.action) %></small> <small><%= local_time_ago(audit.created_at) %></small>
           <%= t('.by') %> <%= audit.user&.email %> <%= t('.from') %> <%= audit.remote_address %> <%= t('.version', version: audit.version) %>
         </p>
         <table class="table is-bordered is-narrow is-hoverable is-striped is-fullwidth">
@@ -22,7 +22,7 @@
             <tr>
               <% old = value.is_a?(Array) ? value[0] : nil %>
               <% new = value.is_a?(Array) ? value[1] : value %>
-              <td><%= audit.auditable_type.constantize.human_attribute_name(key) %></td>
+              <td><%= t("activerecord.attributes.#{audit.auditable_type.underscore}.#{key}") %></td>
               <td title="<%= old %>"><p class="attribute-truncate"><%= old %></p></td>
               <td title="<%= new %>"><p class="attribute-truncate"><%= new %></p></td>
             </tr>