Discourse/discourse
Discourse/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-09-06 10:50:21 +08:00
Code Packages Activity Actions 13

SECURITY: Users can only bookmark posts which they can see.

Browse source
This commit is contained in:
Guo Xiang Tan 2016-12-21 12:01:26 +08:00
parent 1821a0933d
commit 5d7f3223f0
9 changed files with 91 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

7
spec/controllers/posts_controller_spec.rb
View file

@ -426,13 +426,12 @@ describe PostsController do
include_examples 'action requires login', :put, :bookmark, post_id: 2
describe 'when logged in' do
let(:post) { Fabricate(:post, user: log_in) }
let(:private_message) { Fabricate(:private_message_post) }
it "raises an error if the user doesn't have permission to see the post" do
Guardian.any_instance.expects(:can_see?).with(post).returns(false).once
xhr :put, :bookmark, post_id: post.id, bookmarked: 'true'
post
xhr :put, :bookmark, post_id: private_message.id, bookmarked: 'true'
expect(response).to be_forbidden
end