Merge pull request from GHSA-p75c-5x3h-cxcg

CVE-2022-39281 mitigations
fatfreecrm · Oct 7, 2022 · c85a254 · c85a254
2 parents fd2e72d + b1511d8
commit c85a254
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/app/models/polymorphic/task.rb b/app/models/polymorphic/task.rb
@@ -189,6 +189,7 @@ def self.find_all_grouped(user, view)
   #----------------------------------------------------------------------------
   def self.bucket_empty?(bucket, user, view = "pending")
     return false if bucket.blank? || !ALLOWED_VIEWS.include?(view)
+    return false unless Setting.task_bucket.map(&:to_s).include?(bucket.to_s)
 
     if view == "assigned"
       assigned_by(user).send(bucket).pending.count

diff --git a/lib/fat_free_crm/version.rb b/lib/fat_free_crm/version.rb
@@ -9,7 +9,7 @@ module FatFreeCRM
   module VERSION # :nodoc:
     MAJOR = 0
     MINOR = 20
-    TINY  = 0
+    TINY  = 1
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')