Make confirmation text a required field (#10014)

* Make confirmation text a required field

* Use strong params to check if confirmation param is present

* Require config confirmation text to match pattern

app/controllers/admin/configs_controller.rb

@@ -4,6 +4,10 @@ module Admin
 
     before_action :extra_authorization_and_confirmation, only: [:create]
 
+    def show
+      @confirmation_text = confirmation_text
+    end
+
     def create
       clean_up_params
 
@@ -23,6 +27,10 @@ module Admin
 
     private
 
+    def confirmation_text
+      "My username is @#{current_user.username} and this action is 100% safe and appropriate."
+    end
+
     def config_params
       allowed_params = %i[
         ga_view_id
@@ -69,10 +77,13 @@ module Admin
       )
     end
 
+    def raise_confirmation_mismatch_error
+      raise ActionController::BadRequest.new, "The confirmation key does not match"
+    end
+
     def extra_authorization_and_confirmation
       not_authorized unless current_user.has_role?(:single_resource_admin, Config) # Special additional permission
-      confirmation_message = "My username is @#{current_user.username} and this action is 100% safe and appropriate."
-      not_authorized if params[:confirmation] != confirmation_message
+      raise_confirmation_mismatch_error if params.require(:confirmation) != confirmation_text
     end
 
     def clean_up_params

app/views/admin/configs/show.html.erb

@@ -66,8 +66,8 @@
         <% if current_user.has_role?(:single_resource_admin, Config) %>
               <div class="form-group">
                 <%= label_tag "Please type out the sentence below to submit:" %>
-                <%= text_field_tag :confirmation, nil, class: "form-control", placeholder: "Confirmation text", autocomplete: "off" %>
-                <div class="alert alert-info">Type the sentence: My username is @your_username and this action is 100% safe and appropriate.</div>
+                <%= text_field_tag :confirmation, nil, class: "form-control", placeholder: "Confirmation text", autocomplete: "off", required: true, pattern: @confirmation_text %>
+                <div class="alert alert-info">Type the sentence: <%= @confirmation_text %></div>
                 <%= f.submit "Update Site Configuration", class: "btn btn-danger btn-lg" %>
               </div>
         <% end %>
@@ -965,8 +965,8 @@
             <div class="card-body">
               <div class="form-group">
                 <%= label_tag :confirmation %>
-                <%= text_field_tag :confirmation, nil, class: "form-control", placeholder: "Confirmation text", autocomplete: "off" %>
-                <div class="alert alert-info">Type the sentence: My username is @your_username and this action is 100% safe and appropriate.</div>
+                <%= text_field_tag :confirmation, nil, class: "form-control", placeholder: "Confirmation text", autocomplete: "off", required: true, pattern: @confirmation_text %>
+                <div class="alert alert-info">Type the sentence: <%= @confirmation_text %></div>
                 <%= f.submit "Update Site Configuration", class: "btn btn-danger btn-lg" %>
               </div>
             </div>

spec/requests/admin/configs_spec.rb

@@ -155,7 +155,7 @@ RSpec.describe "/admin/config", type: :request do
           expect do
             post "/admin/config", params: { site_config: { periodic_email_digest_min: 6 },
                                             confirmation: "Incorrect yo!" }
-          end.to raise_error Pundit::NotAuthorizedError
+          end.to raise_error ActionController::BadRequest
           expect(SiteConfig.periodic_email_digest_min).not_to eq(6)
         end
       end
@@ -238,7 +238,15 @@ RSpec.describe "/admin/config", type: :request do
           expect do
             post "/admin/config", params: { site_config: { logo_svg: expected_image_url },
                                             confirmation: "Incorrect yo!" }
-          end.to raise_error Pundit::NotAuthorizedError
+          end.to raise_error ActionController::BadRequest
+        end
+
+        it "rejects update without any confirmation" do
+          expected_image_url = "https://dummyimage.com/300x300"
+          expect do
+            post "/admin/config", params: { site_config: { logo_svg: expected_image_url },
+                                            confirmation: "" }
+          end.to raise_error ActionController::ParameterMissing
         end
       end
 
@@ -329,7 +337,7 @@ RSpec.describe "/admin/config", type: :request do
             expect do
               params = { site_config: { shop_url: expected_shop_url }, confirmation: "Incorrect confirmation" }
               post "/admin/config", params: params
-            end.to raise_error(Pundit::NotAuthorizedError)
+            end.to raise_error ActionController::BadRequest
 
             expect(SiteConfig.shop_url).not_to eq(expected_shop_url)
           end
@@ -538,8 +546,8 @@ RSpec.describe "/admin/config", type: :request do
           twitter_hashtag = "#DEVCommunity"
           params = { site_config: { twitter_hashtag: twitter_hashtag }, confirmation: "Incorrect confirmation" }
 
-          it "does not update the twitter hashtag" do
-            expect { post "/admin/config", params: params }.to raise_error Pundit::NotAuthorizedError
+          it "does not update the twitter hashtag without the correct confirmation text" do
+            expect { post "/admin/config", params: params }.to raise_error ActionController::BadRequest
           end
 
           it "updates the twitter hashtag" do