Fix #3448: Lower the limit for tag category changes.

Also allow admins to bypass all restrictions.

app/models/tag.rb

@@ -949,7 +949,8 @@ class Tag < ApplicationRecord
   end
 
   def editable_by?(user)
-    return true if !is_locked? && user.is_builder? && post_count < 10_000
+    return true if user.is_admin?
+    return true if !is_locked? && user.is_builder? && post_count < 1_000
     return true if !is_locked? && user.is_member? && post_count < 50
     return false
   end

test/functional/tags_controller_test.rb

@@ -73,6 +73,14 @@ class TagsControllerTest < ActionController::TestCase
         @tag.reload
         assert_equal(1, @tag.category)
       end
+
+      should "not change category when the tag is too large to be changed by a builder" do
+        @tag.update_columns(post_count: 1001)
+        post :update, {:id => @tag.id, :tag => {:category => "1"}}, {:user_id => @user.id}
+
+        assert_response :forbidden
+        assert_equal(0, @tag.reload.category)
+      end
     end
   end
 end

test/unit/tag_test.rb

@@ -2,8 +2,8 @@ require 'test_helper'
 
 class TagTest < ActiveSupport::TestCase
   setup do
-    user = FactoryGirl.create(:builder_user)
+    @builder = FactoryGirl.create(:builder_user)
-    CurrentUser.user = user
+    CurrentUser.user = @builder
     CurrentUser.ip_addr = "127.0.0.1"
   end
 
@@ -206,6 +206,20 @@ class TagTest < ActiveSupport::TestCase
       assert_equal(0, tag.category)
     end
 
+    should "not change category when the tag is too large to be changed by a builder" do
+      tag = FactoryGirl.create(:tag, post_count: 1001)
+      Tag.find_or_create_by_name("artist:#{tag.name}", creator: @builder)
+
+      assert_equal(0, tag.reload.category)
+    end
+
+    should "not change category when the tag is too large to be changed by a member" do
+      tag = FactoryGirl.create(:tag, post_count: 51)
+      Tag.find_or_create_by_name("artist:#{tag.name}", creator: FactoryGirl.create(:member_user))
+
+      assert_equal(0, tag.reload.category)
+    end
+
     should "be created when one doesn't exist" do
       assert_difference("Tag.count", 1) do
         tag = Tag.find_or_create_by_name("hoge")