fixes #2470: Neutral records to keep track of permissions

test/functional/users_controller_test.rb

@@ -70,6 +70,32 @@ class UsersControllerTest < ActionController::TestCase
         @user.reload
         assert_equal("xyz", @user.favorite_tags)
       end
+
+      context "changing the level" do
+        setup do
+          @cuser = FactoryGirl.create(:user)
+        end
+
+        should "not work if the current user is not an admin" do
+          post :update, {:id => @user.id, :user => {:level => 40}}, {:user_id => @cuser.id}
+          @user.reload
+          assert_equal(20, @user.level)
+        end
+
+        context "where the current user is an admin" do
+          setup do
+            @admin = FactoryGirl.create(:admin_user)
+          end
+
+          should "create a user feedback" do
+            assert_difference("UserFeedback.count") do
+              post :update, {:id => @user.id, :user => {:level => 40}}, {:user_id => @admin.id}
+            end
+            @user.reload
+            assert_equal(40, @user.level)
+          end
+        end
+      end
     end
   end
 end