jaculabilis/danbooru
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix #4541: Possible to create new user while logged in.

Browse Source
This commit is contained in:
evazion
2020-07-13 19:08:45 -05:00
parent ed79b623cc
commit 7f2eaeb02b
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/policies/user_policy.rb
View File

@@ -1,6 +1,6 @@
class UserPolicy < ApplicationPolicy class UserPolicy < ApplicationPolicy
def create? def create?
!sockpuppet? user.is_anonymous? && !sockpuppet?
end end
def update? def update?

5
test/functional/users_controller_test.rb
View File

@@ -165,6 +165,11 @@ class UsersControllerTest < ActionDispatch::IntegrationTest
assert_no_enqueued_emails assert_no_enqueued_emails
end end
should "not allow logged in users to create a new account" do
post_auth users_path, @user, params: { user: { name: "xxx", password: "xxxxx1", password_confirmation: "xxxxx1" }}
assert_response 403
end
should "create a user with a valid email" do should "create a user with a valid email" do
post users_path, params: { user: { name: "xxx", password: "xxxxx1", password_confirmation: "xxxxx1", email: "webmaster@danbooru.donmai.us" }} post users_path, params: { user: { name: "xxx", password: "xxxxx1", password_confirmation: "xxxxx1", email: "webmaster@danbooru.donmai.us" }}