diff options
| author | Robert Speicher <rspeicher@gmail.com> | 2017-12-14 22:32:55 +0300 |
|---|---|---|
| committer | Robert Speicher <rspeicher@gmail.com> | 2017-12-20 00:45:08 +0300 |
| commit | 3e4b45fc216875ff25647675d92448a53a740d9b (patch) | |
| tree | 836b9459d674c2aa0c34e63ed3f4c55999729d1f /spec/features/milestone_spec.rb | |
| parent | 8d0ad36bcfc0ef95ee9a116604ba1516367dbb27 (diff) | |
Only include the user's ID in the time_spent command's update hash
Previously, this would include the entire User record in the update
hash, which was rendered in the response using `to_json`, erroneously
exposing every attribute of that record, including their (now removed)
private token.
Now we only include the user ID, and perform the lookup on-demand.
Diffstat (limited to 'spec/features/milestone_spec.rb')
| -rw-r--r-- | spec/features/milestone_spec.rb | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/spec/features/milestone_spec.rb b/spec/features/milestone_spec.rb index 27efc32c95b..9f24193a2ac 100644 --- a/spec/features/milestone_spec.rb +++ b/spec/features/milestone_spec.rb @@ -82,9 +82,9 @@ feature 'Milestone' do milestone = create(:milestone, project: project, title: 8.7) issue1 = create(:issue, project: project, milestone: milestone) issue2 = create(:issue, project: project, milestone: milestone) - issue1.spend_time(duration: 3600, user: user) + issue1.spend_time(duration: 3600, user_id: user.id) issue1.save! - issue2.spend_time(duration: 7200, user: user) + issue2.spend_time(duration: 7200, user_id: user.id) issue2.save! visit project_milestone_path(project, milestone) |