From d24c746417935718cb1fe33d485d6a1e778f2bfe Mon Sep 17 00:00:00 2001 From: evazion Date: Fri, 27 Mar 2020 04:23:32 -0500 Subject: [PATCH] Fix #4360: Something broke random=true. When random mode is enabled @post_set.posts returns an array, which caused `authorize` to try to lookup the wrong policy. This only happens when `authorize` is given an array with more than one element, which is why it wasn't caught by the tests. --- app/controllers/posts_controller.rb | 2 +- test/functional/posts_controller_test.rb | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/app/controllers/posts_controller.rb b/app/controllers/posts_controller.rb index 722ef96a8..a469130a8 100644 --- a/app/controllers/posts_controller.rb +++ b/app/controllers/posts_controller.rb @@ -11,7 +11,7 @@ class PostsController < ApplicationController else tag_query = params[:tags] || params.dig(:post, :tags) @post_set = PostSets::Post.new(tag_query, params[:page], params[:limit], raw: params[:raw], random: params[:random], format: params[:format]) - @posts = authorize @post_set.posts + @posts = authorize @post_set.posts, policy_class: PostPolicy respond_with(@posts) do |format| format.atom end diff --git a/test/functional/posts_controller_test.rb b/test/functional/posts_controller_test.rb index 5ff04d3e6..be346c32a 100644 --- a/test/functional/posts_controller_test.rb +++ b/test/functional/posts_controller_test.rb @@ -105,6 +105,13 @@ class PostsControllerTest < ActionDispatch::IntegrationTest get posts_path(format: :json), params: { random: "1" } assert_response :success end + + should "render with multiple posts" do + @posts = create_list(:post, 2) + + get posts_path, params: { random: "1" } + assert_response :success + end end context "with the .atom format" do