don't use dynamic render path, fixes brakeman security vuln

moredip · Mar 10, 2016 · 86a8779 · 86a8779
1 parent fef7b26
commit 86a8779
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/app/controllers/errors_controller.rb b/app/controllers/errors_controller.rb
@@ -1,6  1,7 @@
 class ErrorsController < ApplicationController
   def show
     status_code = params[:status_code]
-    render template: "errors/#{status_code}", status: status_code
     template_name = status_code == "404" ? "errors/404" : "errors/500"
     render template: template_name, status: status_code
   end
 end