{"action":"created","issue":{"url":"https://api.github.com/repos/drusepth/Indent/issues/361","labels_url":"https://api.github.com/repos/drusepth/Indent/issues/361/labels{/name}","comments_url":"https://api.github.com/repos/drusepth/Indent/issues/361/comments","events_url":"https://api.github.com/repos/drusepth/Indent/issues/361/events","html_url":"https://github.com/drusepth/Indent/issues/361","id":37750574,"number":361,"title":"Privacy value not validated for presence","user":{"login":"Cantido","id":1505603,"avatar_url":"https://avatars.githubusercontent.com/u/1505603?v=3","gravatar_id":"","url":"https://api.github.com/users/Cantido","html_url":"https://github.com/Cantido","followers_url":"https://api.github.com/users/Cantido/followers","following_url":"https://api.github.com/users/Cantido/following{/other_user}","gists_url":"https://api.github.com/users/Cantido/gists{/gist_id}","starred_url":"https://api.github.com/users/Cantido/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Cantido/subscriptions","organizations_url":"https://api.github.com/users/Cantido/orgs","repos_url":"https://api.github.com/users/Cantido/repos","events_url":"https://api.github.com/users/Cantido/events{/privacy}","received_events_url":"https://api.github.com/users/Cantido/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/drusepth/Indent/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/drusepth/Indent/labels/High%20Priority","name":"High Priority","color":"f7c6c7"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/drusepth/Indent/milestones/27","html_url":"https://github.com/drusepth/Indent/milestones/Universe%20Revamp","labels_url":"https://api.github.com/repos/drusepth/Indent/milestones/27/labels","id":392846,"number":27,"title":"Universe Revamp","description":"Revisions to Universes to treat them more like a site-wide filter than another piece of content.","creator":{"login":"drusepth","id":538235,"avatar_url":"https://avatars.githubusercontent.com/u/538235?v=3","gravatar_id":"","url":"https://api.github.com/users/drusepth","html_url":"https://github.com/drusepth","followers_url":"https://api.github.com/users/drusepth/followers","following_url":"https://api.github.com/users/drusepth/following{/other_user}","gists_url":"https://api.github.com/users/drusepth/gists{/gist_id}","starred_url":"https://api.github.com/users/drusepth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/drusepth/subscriptions","organizations_url":"https://api.github.com/users/drusepth/orgs","repos_url":"https://api.github.com/users/drusepth/repos","events_url":"https://api.github.com/users/drusepth/events{/privacy}","received_events_url":"https://api.github.com/users/drusepth/received_events","type":"User","site_admin":false},"open_issues":10,"closed_issues":10,"state":"open","created_at":"2013-08-02T08:57:04Z","updated_at":"2014-08-10T18:39:49Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2014-07-13T22:26:49Z","updated_at":"2015-03-18T01:45:14Z","closed_at":null,"body":"Since all of the models' Privacy values are not required to be present, any request to show that content could cause the following exception:\r\n````\r\nNoMethodError: undefined method `downcase' for nil:NilClass\r\n    app/controllers/application_controller.rb:215:in `hide_private_character'\r\n    test/controllers/characters_controller_test.rb:34:in `block in <class:CharactersControllerTest>'\r\n````\r\n\r\nThis is due to [this line][1] for the Universe controller, similar for the other models:\r\n\r\n```ruby\r\nunless (session[:user] and session[:user] == character.user.id) or (character.universe and character.universe.privacy.downcase == 'public')\r\n```\r\nwhich doesn't check the presence of `character.universe.privacy` first. The rest of the privacy checks here have the same problem, I just came across it while debugging the characters controller.\r\n\r\nThe form to create a universe does provide a default, but since your code is assuming that the value is present, this value should be enforced as not null by the database, or the code should check for nil.\r\n\r\n[1]: https://github.com/drusepth/Indent/blob/master/app/controllers/application_controller.rb#L215"},"comment":{"url":"https://api.github.com/repos/drusepth/Indent/issues/comments/82675992","html_url":"https://github.com/drusepth/Indent/issues/361#issuecomment-82675992","issue_url":"https://api.github.com/repos/drusepth/Indent/issues/361","id":82675992,"user":{"login":"Cantido","id":1505603,"avatar_url":"https://avatars.githubusercontent.com/u/1505603?v=3","gravatar_id":"","url":"https://api.github.com/users/Cantido","html_url":"https://github.com/Cantido","followers_url":"https://api.github.com/users/Cantido/followers","following_url":"https://api.github.com/users/Cantido/following{/other_user}","gists_url":"https://api.github.com/users/Cantido/gists{/gist_id}","starred_url":"https://api.github.com/users/Cantido/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Cantido/subscriptions","organizations_url":"https://api.github.com/users/Cantido/orgs","repos_url":"https://api.github.com/users/Cantido/repos","events_url":"https://api.github.com/users/Cantido/events{/privacy}","received_events_url":"https://api.github.com/users/Cantido/received_events","type":"User","site_admin":false},"created_at":"2015-03-18T01:45:13Z","updated_at":"2015-03-18T01:45:13Z","body":"So, should we validate presence of the privacy field for all models, or just do a check for null in all the controllers? My vote is for model-layer validation."}}