From e2a5be6e9a070792fa72711c812f75bc61990052 Mon Sep 17 00:00:00 2001 From: ThibG Date: Sat, 26 Jan 2019 23:59:39 +0100 Subject: Prevent posting toots with media attachments from someone else (#9921) --- spec/services/post_status_service_spec.rb | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) (limited to 'spec/services/post_status_service_spec.rb') diff --git a/spec/services/post_status_service_spec.rb b/spec/services/post_status_service_spec.rb index 680cebbcf..facbe977f 100644 --- a/spec/services/post_status_service_spec.rb +++ b/spec/services/post_status_service_spec.rb @@ -167,7 +167,7 @@ RSpec.describe PostStatusService, type: :service do it 'attaches the given media to the created status' do account = Fabricate(:account) - media = Fabricate(:media_attachment) + media = Fabricate(:media_attachment, account: account) status = subject.call( account, @@ -178,6 +178,19 @@ RSpec.describe PostStatusService, type: :service do expect(media.reload.status).to eq status end + it 'does not attach media from another account to the created status' do + account = Fabricate(:account) + media = Fabricate(:media_attachment, account: Fabricate(:account)) + + status = subject.call( + account, + text: "test status update", + media_ids: [media.id], + ) + + expect(media.reload.status).to eq nil + end + it 'does not allow attaching more than 4 files' do account = Fabricate(:account) -- cgit