50bdfd5488
In theory it's possible to add a `host` parameter to a URL, and we could end up redirecting to that host if we just redirect using query parameters. Generating the path using `url_for` with `only_path` solves the issue. Note in the tests I'm using the `get` method because the `patch` method wouldn't send query parameters. This doesn't mean the action can be accessed through GET requests, since controller tests don't check route verbs. Using feature specs doesn't seem to work because `controller` and `host` parameters are filtered automatically in feature specs. Also note I'm not testing every hidden/moderation controller because they basically use the same code.
26 lines
754 B
Ruby
26 lines
754 B
Ruby
require "rails_helper"
|
|
|
|
describe Admin::HiddenDebatesController do
|
|
before { sign_in create(:administrator).user }
|
|
|
|
describe "PUT confirm_hide" do
|
|
it "keeps query parameters while using protected redirects" do
|
|
debate = create(:debate, :hidden)
|
|
|
|
get :confirm_hide, params: { id: debate, filter: "all", host: "evil.dev" }
|
|
|
|
expect(response).to redirect_to "/admin/hidden_debates?filter=all"
|
|
end
|
|
end
|
|
|
|
describe "PUT restore" do
|
|
it "keeps query parameters while using protected redirects" do
|
|
debate = create(:debate, :hidden, :with_confirmed_hide)
|
|
|
|
get :restore, params: { id: debate, filter: "all", host: "evil.dev" }
|
|
|
|
expect(response).to redirect_to "/admin/hidden_debates?filter=all"
|
|
end
|
|
end
|
|
end
|