Nemcio/Redmine
1
0
Fork 0
mirror of https://github.com/redmine/redmine.git synced 2026-08-05 19:29:28 +02:00
Code Issues Packages Projects Releases Activity

Wrap journal attributes with a journal parameter and use safe_attributes (#22575).

Browse Source 
git-svn-id: http://svn.redmine.org/redmine/trunk@15621 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang
2016-07-10 10:58:00 +00:00
parent 7918285ac2
commit 1f9bbd6b42
5 changed files with 23 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
test/functional/journals_controller_test.rb
View File

@@ -199,7 +199,7 @@ class JournalsControllerTest < ActionController::TestCase
def test_update_xhr
@request.session[:user_id] = 1
xhr :post, :update, :id => 2, :notes => 'Updated notes'
xhr :post, :update, :id => 2, :journal => {:notes => 'Updated notes'}
assert_response :success
assert_template 'update'
assert_equal 'text/javascript', response.content_type
@@ -209,7 +209,7 @@ class JournalsControllerTest < ActionController::TestCase
def test_update_xhr_with_private_notes_checked
@request.session[:user_id] = 1
xhr :post, :update, :id => 2, :private_notes => '1'
xhr :post, :update, :id => 2, :journal => {:private_notes => '1'}
assert_response :success
assert_template 'update'
assert_equal 'text/javascript', response.content_type
@@ -221,7 +221,7 @@ class JournalsControllerTest < ActionController::TestCase
def test_update_xhr_with_private_notes_unchecked
Journal.find(2).update_attributes(:private_notes => true)
@request.session[:user_id] = 1
xhr :post, :update, :id => 2
xhr :post, :update, :id => 2, :journal => {:private_notes => '0'}
assert_response :success
assert_template 'update'
assert_equal 'text/javascript', response.content_type
@@ -230,20 +230,21 @@ class JournalsControllerTest < ActionController::TestCase
assert_include 'journal-2-private_notes', response.body
end
def test_update_xhr_with_private_notes_changes_and_without_set_private_notes_permission
def test_update_xhr_without_set_private_notes_permission_should_ignore_private_notes
@request.session[:user_id] = 2
Role.find(1).add_permission! :edit_issue_notes
Role.find(1).add_permission! :view_private_notes
Role.find(1).remove_permission! :set_notes_private
xhr :post, :update, :id => 2, :private_notes => '1'
assert_response 403
xhr :post, :update, :id => 2, :journal => {:private_notes => '1'}
assert_response :success
assert_equal false, Journal.find(2).private_notes
end
def test_update_xhr_with_empty_notes_should_delete_the_journal
@request.session[:user_id] = 1
assert_difference 'Journal.count', -1 do
xhr :post, :update, :id => 2, :notes => ''
xhr :post, :update, :id => 2, :journal => {:notes => ''}
assert_response :success
assert_template 'update'
assert_equal 'text/javascript', response.content_type