maverick/docbrown
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
docbrown/spec/requests
History
Jeremy Friesen 4509e81dd5
Ensuring the same policies for analytics (#16997) 
Prior to this commit the following situation existed:

> The path /dashboard/analytics/org/:id requires user
> authentication (e.g. signed in). However, it does not enforce
> authorization. Anyone can see this page. The page, however, uses
> javascript to populate the data. So no information, aside from the org
> name associated with the :id leaks out. The javascript API end point
> enforces organization membership.
>
> I would expect that the authorization in the HTML rendering would be
> the same as the javascript API end point.

This commit ensures that the dashboards#analytics end point uses the
same policy logic as the API analytics end points.  Further, it keeps
folks who aren't org members out of the base HTML page for other orgs.

Closes forem/forem/#16985
2022-03-25 14:57:01 -04:00
..
admin Introduce "extensions" (#16840) 2022-03-18 11:22:17 +02:00
api/v0 Routine Rubocop fixes (#16838) 2022-03-09 09:32:50 -05:00
articles Fix missing dc:creator on RSS feed (#16898) 2022-03-16 17:15:15 -04:00
incoming_webhooks/mailchimp Use new UserSetting and UserNotificationSettings and Ignore Related User Table Fields (#14121) 2021-07-08 09:31:34 -05:00
notifications [deploy] Remove All Notification Count Helper Classes (#8221) 2020-06-02 09:48:02 -05:00
podcasts Refactoring questions asked of user (#15762) 2021-12-21 12:45:12 -05:00
shared_examples Routine Rubocop fixes (#16838) 2022-03-09 09:32:50 -05:00
stories Use the canonical URLs to link from sorted pages (#16928) 2022-03-22 14:51:36 +00:00
user Routine Rubocop fixes (#16838) 2022-03-09 09:32:50 -05:00
api_secrets_create_spec.rb Rubocop: move dot in multi-line calls to leading position (#9262) 2020-07-16 15:51:11 +02:00
api_secrets_destroy_spec.rb Fix access token revoking (#3131) 2019-06-11 15:53:58 -04:00
article_approvals_spec.rb Routine Rubocop fixes (#16838) 2022-03-09 09:32:50 -05:00
async_info_spec.rb Remove Creator Onboarding Feature Flags from Codebase (#15982) 2022-01-31 11:30:43 -07:00
badges_spec.rb Add badges index page. (#4236) 2019-10-06 17:34:52 -04:00
collections_spec.rb Show correct number in series truncation. (#13799) 2021-05-24 15:47:06 -06:00
comments_create_spec.rb Routine Rubocop fixes (#16838) 2022-03-09 09:32:50 -05:00
comments_destroy_spec.rb Routine Rubocop fixes (#16838) 2022-03-09 09:32:50 -05:00
comments_spec.rb Routine Rubocop fixes (#16838) 2022-03-09 09:32:50 -05:00
comments_update_spec.rb [deploy] Remove redirect on comments#update (#10337) 2020-09-29 15:33:51 -04:00
credits_spec.rb [deploy] Rename classified listings (#7910) 2020-05-27 13:35:09 +00:00
dashboard_spec.rb Ensuring the same policies for analytics (#16997) 2022-03-25 14:57:01 -04:00
devices_spec.rb ForemMobile namespaced functions (#15212) 2021-11-23 15:25:29 -06:00
discussion_locks_spec.rb Spelling (#15702) 2021-12-07 06:59:10 -07:00
display_ad_events_spec.rb Extracting constants and tidying tests (#15946) 2022-01-05 09:19:39 -05:00
editor_spec.rb Adjusting ArticlePolicy for admin only posting (#16614) 2022-02-21 10:09:13 -05:00
email_subscriptions_spec.rb Use new UserSetting and UserNotificationSettings and Ignore Related User Table Fields (#14121) 2021-07-08 09:31:34 -05:00
feedback_messages_spec.rb Routine Rubocop fixes (#16838) 2022-03-09 09:32:50 -05:00
followings_spec.rb Refactoring to add helper method (#16064) 2022-01-12 11:21:44 -05:00
follows_bulk_show_spec.rb Spelling (#15702) 2021-12-07 06:59:10 -07:00
follows_bulk_update_spec.rb Update all followed tag with one click (#11454) 2021-01-05 16:15:37 +01:00
follows_create_spec.rb Clear the cached settings before testing the rate limiter (#13669) 2021-05-05 14:34:22 -05:00
follows_show_spec.rb Rubocop: enable and fix Style/Send and Style/Next (#9366) 2020-07-20 16:28:00 +02:00
ga_events_spec.rb Rename SiteConfig to Settings::General (#13573) 2021-05-21 14:45:37 +02:00
github_repos_spec.rb ✂✂✂ Remove Connect (#14734) 2021-11-18 08:21:00 -06:00
html_variant_successes_spec.rb Replace peform_enqueued_jobs with sidekiq_perform_enqueued_jobs in specs (#6454) 2020-03-04 11:39:48 -07:00
html_variant_trials_spec.rb Replace peform_enqueued_jobs with sidekiq_perform_enqueued_jobs in specs (#6454) 2020-03-04 11:39:48 -07:00
image_uploads_spec.rb Refactor:Change Image Article Upload Path to uploads/articles (#12668) 2021-02-15 11:52:00 -06:00
invitations_spec.rb Rename SiteConfig to Settings::General (#13573) 2021-05-21 14:45:37 +02:00
liquid_embeds_spec.rb Move work from template to controller (#16092) 2022-01-18 11:21:25 -05:00
liquid_tags_request_spec.rb [deploy] Add LiquidTagsController (#10241) 2020-09-08 12:07:33 -04:00
listings_spec.rb Routine Rubocop fixes (#16838) 2022-03-09 09:32:50 -05:00
moderations_spec.rb Spelling (#15702) 2021-12-07 06:59:10 -07:00
notification_counts_spec.rb [deploy] Optimization:Use Scope and current_user to Get Notification Count (#8177) 2020-06-01 09:27:46 -05:00
notification_subscriptions_spec.rb Routine Rubocop fixes (#16838) 2022-03-09 09:32:50 -05:00
notifications_spec.rb Rename User.dev_account to User.staff_account (#14321) 2021-07-26 10:46:26 -04:00
onboardings_spec.rb Rename SiteConfig to Settings::General (#13573) 2021-05-21 14:45:37 +02:00
open_search_spec.rb Clean up SiteConfig (#13738) 2021-05-18 09:38:31 +07:00
organizations_update_spec.rb Upgrade Rails to 6.1.3.1 (#11333) 2021-04-05 10:39:48 -04:00
page_views_spec.rb Extract page view updates into workers (#12686) 2021-02-17 09:24:05 +07:00
pages_spec.rb Remove hardcoded /badge page that is DEV-only ✂️✂️✂️ (#16303) 2022-01-27 13:29:05 -05:00
poll_skips_spec.rb Small ActiveRecord optimizations: begone race conditions and hello bulk insert (#8436) 2020-06-15 17:57:14 +02:00
poll_votes_spec.rb Routine Rubocop fixes (#16838) 2022-03-09 09:32:50 -05:00
profile_field_groups_request_spec.rb Deployment Task: Update onboarding fields prior to #11629 (#11704) 2020-12-07 14:57:18 -05:00
profile_pins_spec.rb [deploy] Finalize deleting user associations (#5624) 2020-01-23 11:29:47 -05:00
profile_preview_cards_spec.rb Profile generalization cleanup phase 2 (#14555) 2021-08-27 09:17:26 +07:00
profiles_request_spec.rb Drop profile columns from user (#10707) 2020-12-03 08:14:38 +07:00
rating_votes_spec.rb Add experience level averaging to articles (#1922) 2019-02-28 08:17:29 -08:00
reactions_spec.rb Routine Rubocop fixes (#16838) 2022-03-09 09:32:50 -05:00
reading_list_items_spec.rb [deploy] Fix Reading List Counter Without last_reacted_at Default (#10933) 2020-10-19 13:26:19 -05:00
registrations_spec.rb Routine Rubocop fixes (#16838) 2022-03-09 09:32:50 -05:00
response_templates_spec.rb [deploy] Rubocop: fix violations of Layout/LineLength (#9197) 2020-07-08 08:36:36 -05:00
search_spec.rb Added "Tags" category to search results (#16265) 2022-01-26 20:51:15 +03:00
sidebars_spec.rb Rename SiteConfig to Settings::General (#13573) 2021-05-21 14:45:37 +02:00
sitemaps_spec.rb Fix legacy sitemap logic (#14926) 2021-10-07 08:59:16 -04:00
social_previews_spec.rb Remove SheCoded Specific Code (#13363) 2021-04-12 11:04:58 -07:00
stories_index_spec.rb Use the canonical URLs to link from sorted pages (#16928) 2022-03-22 14:51:36 +00:00
stories_show_spec.rb Moved setting old_username from before_validation to Users::Update (#15782) 2021-12-20 11:08:09 +03:00
stripe_active_cards_spec.rb Routine Rubocop fixes (#16838) 2022-03-09 09:32:50 -05:00
tag_adjustments_spec.rb [deploy] Rubocop: fix violations of Layout/LineLength (#9197) 2020-07-08 08:36:36 -05:00
tags_spec.rb Add ability to bulk search tags by name or id (#16671) 2022-02-24 12:34:50 -05:00
universal_links_spec.rb Add exclusion to AASA supported paths (#14593) 2021-08-26 10:17:39 -06:00
user_blocks_spec.rb Routine Rubocop fixes (#16838) 2022-03-09 09:32:50 -05:00
user_subscriptions_spec.rb Routine Rubocop fixes (#16838) 2022-03-09 09:32:50 -05:00
users_onboarding_spec.rb Routine Rubocop fixes (#16838) 2022-03-09 09:32:50 -05:00
video_states_update_spec.rb Rename SiteConfig to Settings::General (#13573) 2021-05-21 14:45:37 +02:00
videos_spec.rb Ensuring VideoPolicy#new? is canonical (#16735) 2022-03-01 11:46:31 -05:00