fix exploit for viewing private dmails

2016-12-06 14:34:46 -08:00
parent deb62e0cdb
commit 4eb0a64135
2 changed files with 10 additions and 1 deletions
--- a/test/functional/dmails_controller_test.rb
+++ b/test/functional/dmails_controller_test.rb
@@ -22,6 +22,12 @@ class DmailsControllerTest < ActionController::TestCase
      end

      context "with a respond_to_id" do
+        should "check privileges" do
+          @user2 = FactoryGirl.create(:user)
+          get :new, {:respond_to_id => @dmail}, {:user_id => @user2.id}
+          assert_response 403
+        end
+
        should "prefill the fields" do
          get :new, {:respond_to_id => @dmail}, {:user_id => @user.id}
          assert_response :success