diff --git a/app/controllers/classified_listings_controller.rb b/app/controllers/classified_listings_controller.rb index db6f7931c..ced0e3bc4 100644 --- a/app/controllers/classified_listings_controller.rb +++ b/app/controllers/classified_listings_controller.rb @@ -59,6 +59,7 @@ class ClassifiedListingsController < ApplicationController def delete_confirm @classified_listing = ClassifiedListing.find_by(slug: params[:slug]) + not_found unless @classified_listing authorize @classified_listing end diff --git a/spec/requests/classified_listings_spec.rb b/spec/requests/classified_listings_spec.rb index 84687a309..98767dae8 100644 --- a/spec/requests/classified_listings_spec.rb +++ b/spec/requests/classified_listings_spec.rb @@ -476,4 +476,18 @@ RSpec.describe "ClassifiedListings", type: :request do end end end + + describe "GET /delete_confirm" do + let!(:listing) { create(:classified_listing, user: user) } + + before { sign_in user } + + context "without classified listing" do + it "renders not_found" do + expect do + get "/listings/#{listing.category}/#{listing.slug}_1/delete_confirm" + end.to raise_error(ActiveRecord::RecordNotFound) + end + end + end end