anchor.diff:                </i>
                 Hint
               </a>
  +          </div>
             </div>
             <div class="accordion-body collapse" id="collapseFour" style="height: 0px;">
               <div class="accordion-inner">
  
positive.code:           <div class="accordion-body collapse" id="collapseTwo" style="height: 0px;">
              <div class="accordion-inner">
                <p class="desc">
          Rails provides the ability to apply before_filter(s) which run prior to rendering content to the user. This is helpful when restricting access to content based on the user's role. Currently, the methods to apply a before_filter already exist in the application controller but were forgotten when creating the administrative functionality. Notice an asbsence of the before_filter within app/controllers/admin_controller.rb
          </p>
          <pre class="ruby">
          <%= %q{
          class AdminController < ApplicationController
          
            skip_before_filter :has_info
          } %>
          </pre>   
     
  
negative.code:             <div class="accordion-inner">
                <p><b>Failure to Restrict URL Access - ATTACK</b></p>
          <p class="desc">
          Request the following URL: /admin/1/dashboard and have fun :-)
          </p>  
          <p><b>Failure to Restrict URL Access - SOLUTION</b></p>
          <p class="desc">
          The code is already available to restrict access to the admin controller by role within app/controllers/application_controller.rb. The additional condition that if the admin_id param equals 1 means the filter can be circumvented by an attacker. The way to fix this issue is to enforce the filter on all access requests to the admin dashboard as follows:
          </p>
          <pre class="ruby">
          <%= %q{
          class AdminController < ApplicationController
          
            before_filter :administrative, :if => :admin_param
          } %>
          </pre>
          </div>
          </div>
          </div>
        <div class="accordion-group">
            <div class="accordion-heading">
  