fixes #331 "mass assignment" vuln, permit explicit option labels (#332)

GSA · Dec 20, 2024 · 9e51cd5 · 9e51cd5
1 parent 8afdde0
commit 9e51cd5
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/app/controllers/evaluation_forms_controller.rb b/app/controllers/evaluation_forms_controller.rb
@@ -105,7 +105,7 @@ def evaluation_form_params
              evaluation_criteria_attributes: [
                :id, :title, :description, :points_or_weight, :scoring_type,
                :option_range_start, :option_range_end, :_destroy,
-               { option_labels: {} }
+               { option_labels: %i[0 1 2 3 4 5 6 7 8 9 10] }
              ])
     closing_date = parse_closing_date(permitted[:closing_date])
     permitted = permitted.merge({ closing_date: }) if closing_date