diff options
author | Eugen Rochko <eugen@zeonfederated.com> | 2020-02-27 12:32:54 +0100 |
---|---|---|
committer | GitHub <noreply@github.com> | 2020-02-27 12:32:54 +0100 |
commit | 0c28a505dddd13e2773cd3d5e0beef76a21eb415 (patch) | |
tree | efbe459449b07cadedf57e3f344d617ed7a98b39 /spec/controllers/api/v1/statuses/bookmarks_controller_spec.rb | |
parent | 7face973fa1c7d6c18b06d427ea0b7a741d11466 (diff) |
Fix leak of arbitrary statuses through unfavourite action in REST API (#13161)
Diffstat (limited to 'spec/controllers/api/v1/statuses/bookmarks_controller_spec.rb')
-rw-r--r-- | spec/controllers/api/v1/statuses/bookmarks_controller_spec.rb | 67 |
1 files changed, 49 insertions, 18 deletions
diff --git a/spec/controllers/api/v1/statuses/bookmarks_controller_spec.rb b/spec/controllers/api/v1/statuses/bookmarks_controller_spec.rb index b79853718..aa5ca433f 100644 --- a/spec/controllers/api/v1/statuses/bookmarks_controller_spec.rb +++ b/spec/controllers/api/v1/statuses/bookmarks_controller_spec.rb @@ -21,36 +21,67 @@ describe Api::V1::Statuses::BookmarksController do post :create, params: { status_id: status.id } end - it 'returns http success' do - expect(response).to have_http_status(:success) - end + context 'with public status' do + it 'returns http success' do + expect(response).to have_http_status(:success) + end + + it 'updates the bookmarked attribute' do + expect(user.account.bookmarked?(status)).to be true + end + + it 'returns json with updated attributes' do + hash_body = body_as_json - it 'updates the bookmarked attribute' do - expect(user.account.bookmarked?(status)).to be true + expect(hash_body[:id]).to eq status.id.to_s + expect(hash_body[:bookmarked]).to be true + end end - it 'return json with updated attributes' do - hash_body = body_as_json + context 'with private status of not-followed account' do + let(:status) { Fabricate(:status, visibility: :private) } - expect(hash_body[:id]).to eq status.id.to_s - expect(hash_body[:bookmarked]).to be true + it 'returns http not found' do + expect(response).to have_http_status(404) + end end end describe 'POST #destroy' do - let(:status) { Fabricate(:status, account: user.account) } + context 'with public status' do + let(:status) { Fabricate(:status, account: user.account) } - before do - Bookmark.find_or_create_by!(account: user.account, status: status) - post :destroy, params: { status_id: status.id } - end + before do + Bookmark.find_or_create_by!(account: user.account, status: status) + post :destroy, params: { status_id: status.id } + end - it 'returns http success' do - expect(response).to have_http_status(:success) + it 'returns http success' do + expect(response).to have_http_status(:success) + end + + it 'updates the bookmarked attribute' do + expect(user.account.bookmarked?(status)).to be false + end + + it 'returns json with updated attributes' do + hash_body = body_as_json + + expect(hash_body[:id]).to eq status.id.to_s + expect(hash_body[:bookmarked]).to be false + end end - it 'updates the bookmarked attribute' do - expect(user.account.bookmarked?(status)).to be false + context 'with private status that was not bookmarked' do + let(:status) { Fabricate(:status, visibility: :private) } + + before do + post :destroy, params: { status_id: status.id } + end + + it 'returns http not found' do + expect(response).to have_http_status(404) + end end end end |