check that state is permitted

2 files changed, 41 insertions, 1 deletions

diff --git a/perllib/FixMyStreet/App/Controller/Report/Update.pm b/perllib/FixMyStreet/App/Controller/Report/Update.pm
index 41bc3a4bd..5421385fb 100644
--- a/perllib/FixMyStreet/App/Controller/Report/Update.pm
+++ b/perllib/FixMyStreet/App/Controller/Report/Update.pm
@@ -181,11 +181,18 @@ sub check_for_errors : Private {
 
     # they have to be an authority user to update the state
     if ( $c->req->param('state') ) {
-        unless ( $c->user && $c->user->from_authority ) {
+        my $error = 0;
+        $error = 1 unless $c->user && $c->user->from_authority;
+
+        my $state = $c->req->param('state');
+        $error = 1 unless ( grep { $state eq $_ } ( qw/closed fixed investigating planned/, 'in progress', 'fixed', 'fixed - user', 'fixed - council' ) );
+
+        if ( $error ) {
             $c->stash->{errors} ||= [];
             push @{ $c->stash->{errors} }, _('There was a problem with your update. Please try again.');
             return;
         }
+
     }
 
     # let the model check for errors
diff --git a/t/app/controller/report_updates.t b/t/app/controller/report_updates.t
index e5495ebf1..45e8e8c57 100644
--- a/t/app/controller/report_updates.t
+++ b/t/app/controller/report_updates.t
@@ -416,6 +416,39 @@ subtest 'check non authority user cannot change set state' => sub {
     is $report->state, 'confirmed', 'state unchanged';
 };
 
+for my $state ( qw/unconfirmed hidden partial/ ) {
+    subtest "check that update cannot set state to $state" => sub {
+        $mech->log_in_ok( $user->email );
+        $user->from_authority( 1 );
+        $user->update;
+
+        $mech->get_ok("/report/$report_id");
+        $mech->submit_form_ok( {
+                form_number => 2,
+                fields => {
+                    submit_update => 1,
+                    id => $report_id,
+                    name => $user->name,
+                    rznvy => $user->email,
+                    may_show_name => 1,
+                    add_alert => 0,
+                    photo => '',
+                    update => 'this is a forbidden update',
+                    state => $state,
+                },
+            },
+            'submitted with state',
+        );
+
+        is $mech->uri->path, "/report/update", "at /report/update";
+
+        my $errors = $mech->page_errors;
+        is_deeply $errors, [ 'There was a problem with your update. Please try again.' ], 'error message';
+
+        is $report->state, 'confirmed', 'state unchanged';
+    };
+}
+
 for my $test (
     {
         desc => 'from authority user marks report as fixed',