kolan
/
Redmine
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Verify issues are updated by HTTP PUT only. Regression from r3486. 

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@3520 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Eric Davis 2010-03-01 18:29:18 +00:00
parent 8699e5bbcd
commit f5f5a5f64f
2 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/issues_controller.rb
View File

@ -51,6 +51,8 @@ class IssuesController < ApplicationController
:only => :destroy, :only => :destroy,
:render => { :nothing => true, :status => :method_not_allowed } :render => { :nothing => true, :status => :method_not_allowed }
verify :method => :put, :only => :update, :render => {:nothing => true, :status => :method_not_allowed }
def index def index
retrieve_query retrieve_query
sort_init(@query.sort_criteria.empty? ? [['id', 'desc']] : @query.sort_criteria) sort_init(@query.sort_criteria.empty? ? [['id', 'desc']] : @query.sort_criteria)

14
test/functional/issues_controller_test.rb
View File

@ -657,6 +657,20 @@ class IssuesControllerTest < ActionController::TestCase
assert_select_rjs :show, "update" assert_select_rjs :show, "update"
end end
def test_update_using_invalid_http_verbs
@request.session[:user_id] = 2
subject = 'Updated by an invalid http verb'
get :update, :id => 1, :issue => {:subject => subject}
assert_not_equal subject, Issue.find(1).subject
post :update, :id => 1, :issue => {:subject => subject}
assert_not_equal subject, Issue.find(1).subject
delete :update, :id => 1, :issue => {:subject => subject}
assert_not_equal subject, Issue.find(1).subject
end
def test_put_update_without_custom_fields_param def test_put_update_without_custom_fields_param
@request.session[:user_id] = 2 @request.session[:user_id] = 2
ActionMailer::Base.deliveries.clear ActionMailer::Base.deliveries.clear