Merge pull request #275 from tosdr/sec/general-testing

[sec] Ran brakeman

Author: Christopher Talib

Gemfile.lock

@@ -1,6 +1,6 @@
 GIT
   remote: git://github.com/activeadmin/activeadmin.git
-  revision: ee49d3d2d13c3c871a2ce3fe62e29bbc35b5f697
+  revision: dabd8b30874fe177dcc14e5ebda3fd7b892f3c72
   specs:
     activeadmin (2.0.0.alpha)
       arbre (>= 1.1.1)
@@ -70,7 +70,7 @@ GEM
     arbre (1.1.1)
       activesupport (>= 3.0.0)
     arel (8.0.0)
-    autoprefixer-rails (8.0.0)
+    autoprefixer-rails (8.2.0)
       execjs
     babel-source (5.8.35)
     babel-transpiler (0.7.0)
@@ -82,22 +82,22 @@ GEM
       autoprefixer-rails (>= 5.2.1)
       sass (>= 3.3.4)
     builder (3.2.3)
-    byebug (10.0.0)
+    byebug (10.0.2)
     coderay (1.1.2)
     concurrent-ruby (1.0.5)
     crass (1.0.3)
-    devise (4.4.1)
+    devise (4.4.3)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
-      railties (>= 4.1.0, < 5.2)
+      railties (>= 4.1.0, < 6.0)
       responders
       warden (~> 1.2.3)
-    erubi (1.7.0)
+    erubi (1.7.1)
     execjs (2.7.0)
-    ffi (1.9.22)
+    ffi (1.9.23)
     figaro (1.1.1)
       thor (~> 0.14)
-    font-awesome-sass (5.0.6.2)
+    font-awesome-sass (5.0.9)
       sass (>= 3.2)
     formtastic (3.1.5)
       actionpack (>= 3.2.13)
@@ -136,7 +136,7 @@ GEM
     listen (3.0.8)
       rb-fsevent (~> 0.9, >= 0.9.4)
       rb-inotify (~> 0.9, >= 0.9.7)
-    loofah (2.2.1)
+    loofah (2.2.2)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     mail (2.7.0)
@@ -146,22 +146,22 @@ GEM
     mini_portile2 (2.3.0)
     minitest (5.11.3)
     multi_json (1.13.1)
-    nio4r (2.2.0)
+    nio4r (2.3.0)
     nokogiri (1.8.2)
       mini_portile2 (~> 2.3.0)
     orm_adapter (0.5.0)
-    paper_trail (8.1.2)
-      activerecord (>= 4.2, < 5.2)
+    paper_trail (9.0.0)
+      activerecord (>= 4.2, < 5.3)
       request_store (~> 1.1)
     pg (0.21.0)
     polyamorous (1.3.3)
       activerecord (>= 3.0)
-    postmark (1.10.0)
+    postmark (1.11.0)
       json
       rake
-    postmark-rails (0.15.0)
+    postmark-rails (0.16.0)
       actionmailer (>= 3.0.0)
-      postmark (~> 1.10.0)
+      postmark (~> 1.11.0)
     pry (0.11.3)
       coderay (~> 1.1.0)
       method_source (~> 0.9.0)
@@ -175,7 +175,7 @@ GEM
     pundit (1.1.0)
       activesupport (>= 3.0.0)
     rack (2.0.4)
-    rack-test (0.8.2)
+    rack-test (1.0.0)
       rack (>= 1.0, < 3)
     rails (5.1.4)
       actioncable (= 5.1.4)
@@ -192,31 +192,31 @@ GEM
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.0.3)
-      loofah (~> 2.0)
+    rails-html-sanitizer (1.0.4)
+      loofah (~> 2.2, >= 2.2.2)
     railties (5.1.4)
       actionpack (= 5.1.4)
       activesupport (= 5.1.4)
       method_source
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
-    rake (12.3.0)
-    ransack (1.8.7)
+    rake (12.3.1)
+    ransack (1.8.8)
       actionpack (>= 3.0)
       activerecord (>= 3.0)
       activesupport (>= 3.0)
       i18n
       polyamorous (~> 1.3.2)
-    rb-fsevent (0.10.2)
+    rb-fsevent (0.10.3)
     rb-inotify (0.9.10)
       ffi (>= 0.5.0, < 2)
     redis (4.0.1)
-    request_store (1.4.0)
+    request_store (1.4.1)
       rack (>= 1.4)
     responders (2.4.0)
       actionpack (>= 4.2.0, < 5.3)
       railties (>= 4.2.0, < 5.3)
-    sass (3.5.5)
+    sass (3.5.6)
       sass-listen (~> 4.0.0)
     sass-listen (4.0.0)
       rb-fsevent (~> 0.9, >= 0.9.4)
@@ -251,7 +251,7 @@ GEM
     tilt (2.0.8)
     tzinfo (1.2.5)
       thread_safe (~> 0.1)
-    uglifier (4.1.6)
+    uglifier (4.1.8)
       execjs (>= 0.3.0, < 3)
     warden (1.2.7)
       rack (>= 1.0)

app/controllers/api/v1/base_controller.rb

@@ -1,6 +1,6 @@
 class Api::V1::BaseController < ActionController::Base
+  protect_from_forgery with: :exception
   include Pundit
-
   after_action :verify_authorized, except: :index
   after_action :verify_policy_scoped, only: :index
 

app/controllers/api/v1/services_controller.rb

@@ -10,7 +10,7 @@ def show
 
   private
   def set_service
-    @service = Service.find_by(params[:id])
+    @service = Service.find(params[:id])
     authorize @service
   end
 end