From c33d6936b504745d25e5ca232721be708879c143 Mon Sep 17 00:00:00 2001
From: Vaidehi Joshi <vaidehi.sj@gmail.com>
Date: Mon, 10 Feb 2020 16:35:18 -0800
Subject: [PATCH] Do not allow staff_user_id to be mutated (#6009) [deploy]

Allowing ids to be mutated by admins from the /internal/config pages is dangerous.
This could cause issues if an admin tries to update the SiteConfig.staff_user_id to an id that is another user's id, or to an id that isn't valid.
---
 app/controllers/internal/configs_controller.rb |  2 +-
 app/views/internal/configs/show.html.erb       | 10 ----------
 spec/requests/internal/configs_spec.rb         |  5 +++--
 3 files changed, 4 insertions(+), 13 deletions(-)

diff --git a/app/controllers/internal/configs_controller.rb b/app/controllers/internal/configs_controller.rb
index 733907b0c..eee6ded9c 100644
--- a/app/controllers/internal/configs_controller.rb
+++ b/app/controllers/internal/configs_controller.rb
@@ -18,7 +18,7 @@ class Internal::ConfigsController < Internal::ApplicationController
 
   def config_params
     allowed_params = %i[
-      staff_user_id default_site_email social_networks_handle
+      default_site_email social_networks_handle
       main_social_image favicon_url logo_svg
       rate_limit_follow_count_daily
       ga_view_id ga_fetch_rate
diff --git a/app/views/internal/configs/show.html.erb b/app/views/internal/configs/show.html.erb
index e9f6639a3..13d83f3e7 100644
--- a/app/views/internal/configs/show.html.erb
+++ b/app/views/internal/configs/show.html.erb
@@ -12,16 +12,6 @@
       <div class="card mt-3">
         <div class="card-header">Staff</div>
         <div class="card-body">
-          <div class="form-group">
-            <%= f.label :staff_user_id %>
-            <%= f.number_field :staff_user_id,
-                               class: "form-control",
-                               value: SiteConfig.staff_user_id,
-                               min: 1,
-                               placeholder: "1" %>
-            <div class="alert alert-info">User ID of the staff account</div>
-          </div>
-
           <div class="form-group">
             <%= f.label :default_site_email %>
             <%= f.email_field :default_site_email,
diff --git a/spec/requests/internal/configs_spec.rb b/spec/requests/internal/configs_spec.rb
index 234f8511b..074c27052 100644
--- a/spec/requests/internal/configs_spec.rb
+++ b/spec/requests/internal/configs_spec.rb
@@ -20,9 +20,10 @@ RSpec.describe "/internal/config", type: :request do
     end
 
     describe "staff" do
-      it "updates staff_user_id" do
+      it "does not allow the staff_user_id to be updated" do
+        expect(SiteConfig.staff_user_id).to eq(1)
         post "/internal/config", params: { site_config: { staff_user_id: 2 } }
-        expect(SiteConfig.staff_user_id).to eq(2)
+        expect(SiteConfig.staff_user_id).to eq(1)
       end
 
       it "updates default_site_email" do