diff --git a/app/controllers/comments_controller.rb b/app/controllers/comments_controller.rb index 147e77720..84a257916 100644 --- a/app/controllers/comments_controller.rb +++ b/app/controllers/comments_controller.rb @@ -137,14 +137,16 @@ class CommentsController < ApplicationController # DELETE /comments/1.json def destroy authorize @comment - @commentable_path = @comment.commentable.path if @comment.is_childless? @comment.destroy else @comment.deleted = true @comment.save! end - redirect_to URI.parse(@commentable_path).path, notice: "Comment was successfully deleted." + redirect = @comment.commentable&.path || user_path(current_user) + # NOTE: Brakeman doesn't like redirecting to a path, because of a "possible + # unprotected redirect". Using URI.parse().path is the recommended workaround. + redirect_to URI.parse(redirect).path, notice: "Comment was successfully deleted." end def delete_confirm diff --git a/spec/requests/comments_spec.rb b/spec/requests/comments_spec.rb index 9859bdb4f..44caaf75a 100644 --- a/spec/requests/comments_spec.rb +++ b/spec/requests/comments_spec.rb @@ -6,7 +6,7 @@ RSpec.describe "Comments", type: :request do let(:article) { create(:article, user_id: user.id) } let(:podcast) { create(:podcast) } let(:podcast_episode) { create(:podcast_episode, podcast_id: podcast.id) } - let(:comment) do + let!(:comment) do create(:comment, commentable_id: article.id, commentable_type: "Article", @@ -270,4 +270,26 @@ RSpec.describe "Comments", type: :request do describe "PATCH /comments/:comment_id/unhide" do include_examples "PATCH /comments/:comment_id/hide or unhide", path: "unhide", hidden: "false" end + + describe "DELETE /comments/:comment_id" do + before { sign_in user } + + it "deletes a comment if the article is still present" do + delete "/comments/#{comment.id}" + + expect(Comment.find_by(id: comment.id)).to be_nil + expect(response).to redirect_to(comment.commentable.path) + expect(flash[:notice]).to eq("Comment was successfully deleted.") + end + + it "deletes a comment if the article has been deleted" do + article.destroy! + + delete "/comments/#{comment.id}" + + expect(Comment.find_by(id: comment.id)).to be_nil + expect(response).to redirect_to(user_path(user)) + expect(flash[:notice]).to eq("Comment was successfully deleted.") + end + end end