Fix invalid votes from the API being accepted (#12601)

* Fix invalid votes from the API being accepted

Fixes #12556

- Ensure `choice` is an integer instead of silently converting to 0
- Ensure `choice` corresponds to an actual choice of the poll

* Please CodeClimate

diff --git a/app/services/vote_service.rb b/app/services/vote_service.rb
index cb7dce6e8a41caa51d9ff49c363e063a854d69db..19e4533321de0f0640052fc9a0e2fe50355711b8 100644 (file)
--- a/app/services/vote_service.rb
+++ b/app/services/vote_service.rb
@@ -20,7 +20,7 @@ class VoteService < BaseService
 
         ApplicationRecord.transaction do
           @choices.each do |choice|
-            @votes << @poll.votes.create!(account: @account, choice: choice)
+            @votes << @poll.votes.create!(account: @account, choice: Integer(choice))
           end
         end
       else

diff --git a/app/validators/vote_validator.rb b/app/validators/vote_validator.rb
index 2e1818bdb94d3b557efaf726b02f0a6d7f03a90f..b1692562d41598a6aaa93668e9c0d9e1b1527f64 100644 (file)
--- a/app/validators/vote_validator.rb
+++ b/app/validators/vote_validator.rb
@@ -4,10 +4,18 @@ class VoteValidator < ActiveModel::Validator
   def validate(vote)
     vote.errors.add(:base, I18n.t('polls.errors.expired')) if vote.poll.expired?
 
+    vote.errors.add(:base, I18n.t('polls.errors.invalid_choice')) if invalid_choice?(vote)
+
     if vote.poll.multiple? && vote.poll.votes.where(account: vote.account, choice: vote.choice).exists?
       vote.errors.add(:base, I18n.t('polls.errors.already_voted'))
     elsif !vote.poll.multiple? && vote.poll.votes.where(account: vote.account).exists?
       vote.errors.add(:base, I18n.t('polls.errors.already_voted'))
     end
   end
+
+  private
+
+  def invalid_choice?(vote)
+    vote.choice.negative? || vote.choice >= vote.poll.options.size
+  end
 end

diff --git a/config/locales/en.yml b/config/locales/en.yml
index 62f2226e3ab37dd59a52d8587890ec66e31ae55e..d768cef332b21807231839be19afafaf12592334 100644 (file)
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -922,6 +922,7 @@ en:
       duration_too_long: is too far into the future
       duration_too_short: is too soon
       expired: The poll has already ended
+      invalid_choice: The chosen vote option does not exist
       over_character_limit: cannot be longer than %{max} characters each
       too_few_options: must have more than one item
       too_many_options: can't contain more than %{max} items