app/models/locomotive/content_type.rb
# Makes sure the class_name filled in a belongs_to or has_many field
# does not belong to another site. Adds an error if it presents a
# security problem.
#
# @param [ CustomFields::Field ] field The field to check
#
Makes sure the class_name filled in a belongs_to or has_many field
does not belong to another site. Adds an error if it presents a
security problem.
Makes sure the class_name filled in a belongs_to or has_many field does not belong to another site . Adds an error if it presents a security problem .
def ensure_class_name_security(field)
      if field.class_name =~ /^Locomotive::ContentEntry([a-z0-9]+)$/
        content_type = Locomotive::ContentType.find($1) rescue return
        if content_type.site_id != self.site_id
          field.errors.add :class_name, :security
        end
      else
        field.errors.add :class_name, :security
      end
    end
def ensure_class_name_security ( field ) if field . class_name =~ / ^Locomotive::ContentEntry([a-z0-9]+)$ / content_type = Locomotive :: ContentType . find ( $1 ) rescue return if content_type . site_id != self . site_id field . errors . add :class_name , :security end else field . errors . add :class_name , :security end end
Makes sure the class_name filled in a belongs_to or has_many field
does not belong to another site.
Makes sure the class_name filled in a belongs_to or has_many field does not belong to another site .
# if the content type does not exist (anymore), bypass the security checking # for now, does not allow external classes
field
<not_specific>
<not_specific>
field The field to check
field The field to check