From 5bebf628dfb9691f9cfc35839c7a7b7f7ad18b8f Mon Sep 17 00:00:00 2001 From: Sun-Li Beatteay Date: Thu, 23 Jan 2020 13:22:48 -0500 Subject: [PATCH] Update ReadingListItemsController#update to return NotAuthorized (#5658) * change ReadingListItemsController#update to return NotAuthorized if user_id does not match * fix spec description Co-authored-by: rhymes --- app/controllers/reading_list_items_controller.rb | 2 +- spec/requests/reading_list_items_spec.rb | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/app/controllers/reading_list_items_controller.rb b/app/controllers/reading_list_items_controller.rb index ae0a76f3f..211d0ce30 100644 --- a/app/controllers/reading_list_items_controller.rb +++ b/app/controllers/reading_list_items_controller.rb @@ -7,7 +7,7 @@ class ReadingListItemsController < ApplicationController def update @reaction = Reaction.find(params[:id]) - raise if @reaction.user_id != session_current_user_id # Lazy but I'm tired. HACK + not_authorized if @reaction.user_id != session_current_user_id @reaction.status = params[:current_status] == "archived" ? "valid" : "archived" @reaction.save diff --git a/spec/requests/reading_list_items_spec.rb b/spec/requests/reading_list_items_spec.rb index ed2648928..f5ab5c364 100644 --- a/spec/requests/reading_list_items_spec.rb +++ b/spec/requests/reading_list_items_spec.rb @@ -2,8 +2,10 @@ require "rails_helper" RSpec.describe "ReadingListItems", type: :request do let(:user) { create(:user) } + let(:separate_user) { create(:user) } let(:article) { create(:article, user_id: user.id) } let(:reaction) { create(:reaction, reactable: article, user_id: user.id) } + let(:unauthorized_reaction) { create(:reaction, reactable: article, user_id: separate_user.id) } before do sign_in user @@ -26,5 +28,9 @@ RSpec.describe "ReadingListItems", type: :request do put "/reading_list_items/#{reaction.id}", params: { current_status: "archived" } expect(reaction.reload.status).to eq("valid") end + + it "raises NotAuthorizedError if current_user is not the reaction user" do + expect { put "/reading_list_items/#{unauthorized_reaction.id}" }.to raise_error Pundit::NotAuthorizedError + end end end