Jeremy Daer
9f6a4f1cc6
Users could reorder columns they didn't have access to. Fixed by limiting ColumnScoped to User::Accessor#accessible_columns. References https://hackerone.com/reports/3449905
37 lines
1.0 KiB
Ruby
37 lines
1.0 KiB
Ruby
require "test_helper"
|
|
|
|
class Columns::RightPositionsControllerTest < ActionDispatch::IntegrationTest
|
|
setup do
|
|
sign_in_as :kevin
|
|
end
|
|
|
|
test "move column right" do
|
|
board = boards(:writebook)
|
|
columns = board.columns.sorted.to_a
|
|
|
|
column_a = columns[0]
|
|
column_b = columns[1]
|
|
original_position_a = column_a.position
|
|
original_position_b = column_b.position
|
|
|
|
post column_right_position_path(column_a), as: :turbo_stream
|
|
assert_response :success
|
|
|
|
assert_equal original_position_b, column_a.reload.position
|
|
assert_equal original_position_a, column_b.reload.position
|
|
end
|
|
|
|
test "users can only reorder columns in boards they have access to" do
|
|
column = columns(:writebook_triage)
|
|
|
|
post column_right_position_path(column), as: :turbo_stream
|
|
assert_response :success
|
|
|
|
boards(:writebook).update! all_access: false
|
|
boards(:writebook).accesses.revoke_from users(:kevin)
|
|
|
|
post column_right_position_path(column), as: :turbo_stream
|
|
assert_response :not_found
|
|
end
|
|
end
|