From 325bccc1649c928d512ce7c7b11e14566a8c9eeb Mon Sep 17 00:00:00 2001 From: Azul Date: Sun, 17 Sep 2017 09:54:55 +0200 Subject: fix: sanity checks on user params fixes #8801 Includes a test reproducing 500 on lynx We now make use of ActionController::Parameters require and permit methods. --- test/functional/api/users_controller_test.rb | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) (limited to 'test/functional') diff --git a/test/functional/api/users_controller_test.rb b/test/functional/api/users_controller_test.rb index 88ecae0..ee183f9 100644 --- a/test/functional/api/users_controller_test.rb +++ b/test/functional/api/users_controller_test.rb @@ -4,28 +4,42 @@ class Api::UsersControllerTest < ApiControllerTest test "user can change settings" do user = find_record :user - changed_attribs = record_attributes_for :user_with_settings + attribs = record_attributes_for(:user) + changed_attribs = attribs.slice 'login', + 'password_verifier', + 'password_salt' account_settings = stub account_settings.expects(:update).with(changed_attribs) Account.expects(:new).with(user).returns(account_settings) login user - api_put :update, :user => changed_attribs, :id => user.id, :format => :json + api_put :update, :user => attribs, :id => user.id, :format => :json assert_equal user, assigns[:user] assert_response 204 assert @response.body.blank?, "Response should be blank" end + test "deal with empty settings" do + user = find_record :user + login user + assert_raises ActionController::ParameterMissing do + api_put :update, :id => user.id, :format => :json + end + end + test "admin can update user" do user = find_record :user - changed_attribs = record_attributes_for :user_with_settings + attribs = record_attributes_for(:user) + changed_attribs = attribs.slice 'login', + 'password_verifier', + 'password_salt' account_settings = stub account_settings.expects(:update).with(changed_attribs) Account.expects(:new).with(user).returns(account_settings) login :is_admin? => true - api_put :update, :user => changed_attribs, :id => user.id, :format => :json + api_put :update, :user => attribs, :id => user.id, :format => :json assert_equal user, assigns[:user] assert_response 204 -- cgit v1.2.3