diff options
author | Douglas Barbosa Alexandre <dbalexandre@gmail.com> | 2016-06-06 22:13:31 +0300 |
---|---|---|
committer | Douglas Barbosa Alexandre <dbalexandre@gmail.com> | 2016-06-14 01:32:00 +0300 |
commit | b56c45675019baaaf47615d51c08d5caa0734ad3 (patch) | |
tree | b933c21ab49a745a6839aa1127c237ffe7a3a3fb /spec/controllers | |
parent | af8500f43010f42176b2ec1814f0fe7248258b05 (diff) |
Project members with guest role can't access confidential issues
Diffstat (limited to 'spec/controllers')
-rw-r--r-- | spec/controllers/projects/issues_controller_spec.rb | 19 |
1 files changed, 18 insertions, 1 deletions
diff --git a/spec/controllers/projects/issues_controller_spec.rb b/spec/controllers/projects/issues_controller_spec.rb index 78be7e3dc35..cbaa3e0b7b2 100644 --- a/spec/controllers/projects/issues_controller_spec.rb +++ b/spec/controllers/projects/issues_controller_spec.rb @@ -105,6 +105,15 @@ describe Projects::IssuesController do expect(assigns(:issues)).to eq [issue] end + it 'should not list confidential issues for project members with guest role' do + sign_in(member) + project.team << [member, :guest] + + get_issues + + expect(assigns(:issues)).to eq [issue] + end + it 'should list confidential issues for author' do sign_in(author) get_issues @@ -148,7 +157,7 @@ describe Projects::IssuesController do shared_examples_for 'restricted action' do |http_status| it 'returns 404 for guests' do - sign_out :user + sign_out(:user) go(id: unescaped_parameter_value.to_param) expect(response).to have_http_status :not_found @@ -161,6 +170,14 @@ describe Projects::IssuesController do expect(response).to have_http_status :not_found end + it 'returns 404 for project members with guest role' do + sign_in(member) + project.team << [member, :guest] + go(id: unescaped_parameter_value.to_param) + + expect(response).to have_http_status :not_found + end + it "returns #{http_status[:success]} for author" do sign_in(author) go(id: unescaped_parameter_value.to_param) |