osr-plastic/osr-discourse-src
Archived
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
This repository has been archived on 2023-03-18. You can view files and clone it, but cannot push or open issues or pull requests.
a414520742
osr-discourse-src/spec/requests
History
Martin Brennan a414520742
SECURITY: Prevent email from being nil in InviteRedeemer (#19004) 
This commit adds some protections in InviteRedeemer to ensure that email
can never be nil, which could cause issues with inviting the invited
person to private topics since there was an incorrect inner join.

If the email is nil and the invite is scoped to an email, we just use
that invite.email unconditionally.  If a redeeming_user (an existing
user) is passed in when redeeming an email, we use their email to
override the passed in email.  Otherwise we just use the passed in
email.  We now raise an error after all this if the email is still nil.
This commit also adds some tests to catch the private topic fix, and
some general improvements and comments around the invite code.

This commit also includes a migration to delete TopicAllowedUser records
for users who were mistakenly added to topics as part of the invite
redemption process.
2022-11-14 12:02:06 +10:00
..
admin FIX: Ensure moderators_manage_categories_and_groups is respected (#18884) 2022-11-11 11:06:05 +00:00
api DEV: Update rubocop (#18754) 2022-10-26 09:05:15 +08:00
about_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
application_controller_spec.rb Revert "Revert "FEATURE: Preload resources via link header (#18475)" (#18511)" (#18531) 2022-10-11 20:11:44 -03:00
associate_accounts_controller_spec.rb DEV: Automatically require 'rails_helper' in all specs (#16077) 2022-03-01 17:50:50 +00:00
badges_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
bookmarks_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
bootstrap_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
categories_controller_spec.rb FIX: Welcome topic should be hidden on the /categories page as well (#18869) 2022-11-07 09:24:55 -07:00
clicks_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
composer_messages_controller_spec.rb FEATURE: add composer warning when user haven't been seen in a long time (#18340) 2022-09-27 22:06:40 +05:30
csp_reports_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
directory_columns_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
directory_items_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
do_not_disturb_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
drafts_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
email_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
embed_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
exceptions_controller_spec.rb FEATURE: Add page title to 404 pages (#16846) 2022-05-17 18:37:43 +03:00
export_csv_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
extra_locales_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
finish_installation_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
forums_controller_spec.rb DEV: New readonly mode. Only applies to non-staff (#16243) 2022-05-17 13:06:08 -05:00
groups_controller_spec.rb DEV: Remove remaining hardcoded ids (#18735) 2022-10-25 15:29:09 +08:00
hashtags_controller_spec.rb DEV: Add specs for hashtags related code (#18526) 2022-10-11 09:04:51 +10:00
inline_onebox_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
invites_controller_spec.rb SECURITY: Prevent email from being nil in InviteRedeemer (#19004) 2022-11-14 12:02:06 +10:00
list_controller_spec.rb UX: Hide welcome topic from admins as well if not edited (#18807) 2022-11-01 16:17:17 -06:00
metadata_controller_spec.rb DEV: Automatically require 'rails_helper' in all specs (#16077) 2022-03-01 17:50:50 +00:00
notifications_controller_spec.rb DEV: Include pending reviewables in the main tab in the user menu (#18471) 2022-10-05 12:30:02 +03:00
offline_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
omniauth_callbacks_controller_spec.rb Use service account credentials for fetching google hd groups (#18329) 2022-10-13 16:04:42 +01:00
onebox_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
permalinks_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
post_action_users_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
post_actions_controller_spec.rb FEATURE: Introduce personal_message_enabled_groups setting (#18042) 2022-09-26 13:58:40 +10:00
post_readers_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
posts_controller_spec.rb FIX: Exclude hidden topic posts and small actions from the RSS feed. (#18649) 2022-10-18 15:19:54 -03:00
presence_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
published_pages_controller_spec.rb DEV: Rename secure_media to secure_uploads (#18376) 2022-09-29 09:24:33 +10:00
push_notification_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
qunit_controller_spec.rb DEV: Add test-site-settings to asset pipeline (#18935) 2022-11-08 11:54:25 +10:00
reviewable_claimed_topics_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
reviewables_controller_spec.rb DEV: Fix mocha deprecations (#18828) 2022-11-02 10:47:59 +01:00
robots_txt_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
safe_mode_controller_spec.rb DEV: Automatically require 'rails_helper' in all specs (#16077) 2022-03-01 17:50:50 +00:00
search_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
session_controller_spec.rb FIX: Allow email login for admins in staff-writes-only-mode (#18443) 2022-09-30 14:12:49 -05:00
similar_topics_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
site_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
sitemap_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
static_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
steps_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
stylesheets_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
svg_sprite_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
tag_groups_controller_spec.rb DEV: Automatically require 'rails_helper' in all specs (#16077) 2022-03-01 17:50:50 +00:00
tags_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
theme_javascripts_controller_spec.rb DEV: Include theme_uploads and theme_uploads_local objects in theme tests (#18645) 2022-10-20 08:00:29 +03:00
topics_controller_spec.rb FIX: Remove public topic invite functionality (#18488) 2022-10-10 19:21:51 +03:00
uploads_controller_multisite_spec.rb DEV: Rename secure_media to secure_uploads (#18376) 2022-09-29 09:24:33 +10:00
uploads_controller_spec.rb DEV: Rename secure_media to secure_uploads (#18376) 2022-09-29 09:24:33 +10:00
user_actions_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
user_api_keys_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
user_avatars_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
user_badges_controller_spec.rb SECURITY: Restrict display of topic titles associated with user badges (#18768) 2022-10-27 11:26:14 +08:00
user_status_controller_spec.rb Add RSpec 4 compatibility (#17652) 2022-07-28 10:27:38 +08:00
users_controller_spec.rb FIX: Follow up fixes for password-reset error page (#18794) 2022-10-28 15:41:26 -06:00
users_email_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
webhooks_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00
wizard_controller_spec.rb DEV: Use proper wording for contexts in specs 2022-08-04 11:05:02 +02:00