Merge pull request #3454 from evazion/fix-3448

Fix #3448: Lower the limit for tag category changes

test/functional/tags_controller_test.rb

@@ -73,6 +73,14 @@ class TagsControllerTest < ActionController::TestCase
         @tag.reload
         assert_equal(1, @tag.category)
       end
+
+      should "not change category when the tag is too large to be changed by a builder" do
+        @tag.update_columns(post_count: 1001)
+        post :update, {:id => @tag.id, :tag => {:category => "1"}}, {:user_id => @user.id}
+
+        assert_response :forbidden
+        assert_equal(0, @tag.reload.category)
+      end
     end
   end
 end

test/unit/tag_test.rb

@@ -2,8 +2,8 @@ require 'test_helper'
 
 class TagTest < ActiveSupport::TestCase
   setup do
-    user = FactoryGirl.create(:builder_user)
-    CurrentUser.user = user
+    @builder = FactoryGirl.create(:builder_user)
+    CurrentUser.user = @builder
     CurrentUser.ip_addr = "127.0.0.1"
   end
 
@@ -112,11 +112,9 @@ class TagTest < ActiveSupport::TestCase
 
     should "reset its category after updating" do
       tag = FactoryGirl.create(:artist_tag)
-      tag.update_category_cache_for_all
       assert_equal(Tag.categories.artist, Cache.get("tc:#{Cache.hash(tag.name)}"))
 
       tag.update_attribute(:category, Tag.categories.copyright)
-      tag.update_category_cache_for_all
       assert_equal(Tag.categories.copyright, Cache.get("tc:#{Cache.hash(tag.name)}"))
     end
 
@@ -208,6 +206,20 @@ class TagTest < ActiveSupport::TestCase
       assert_equal(0, tag.category)
     end
 
+    should "not change category when the tag is too large to be changed by a builder" do
+      tag = FactoryGirl.create(:tag, post_count: 1001)
+      Tag.find_or_create_by_name("artist:#{tag.name}", creator: @builder)
+
+      assert_equal(0, tag.reload.category)
+    end
+
+    should "not change category when the tag is too large to be changed by a member" do
+      tag = FactoryGirl.create(:tag, post_count: 51)
+      Tag.find_or_create_by_name("artist:#{tag.name}", creator: FactoryGirl.create(:member_user))
+
+      assert_equal(0, tag.reload.category)
+    end
+
     should "be created when one doesn't exist" do
       assert_difference("Tag.count", 1) do
         tag = Tag.find_or_create_by_name("hoge")