diff options
| -rw-r--r-- | app/controllers/application_controller.rb | 1 | ||||
| -rw-r--r-- | app/controllers/request_controller.rb | 8 | ||||
| -rw-r--r-- | spec/controllers/request_controller_spec.rb | 2 | ||||
| -rw-r--r-- | spec/integration/create_request_spec.rb | 44 |
4 files changed, 53 insertions, 2 deletions
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index b681f455d..434f12a49 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -294,6 +294,7 @@ class ApplicationController < ActionController::Base if params[:post_redirect] and session[:post_redirect_token] post_redirect = PostRedirect.find_by_token(session[:post_redirect_token]) params.update(post_redirect.post_params) + params[:post_redirect_user] = post_redirect.user end end diff --git a/app/controllers/request_controller.rb b/app/controllers/request_controller.rb index b484ec514..7ca081c04 100644 --- a/app/controllers/request_controller.rb +++ b/app/controllers/request_controller.rb @@ -347,7 +347,13 @@ class RequestController < ApplicationController return end - @info_request.user = authenticated_user + if params[:post_redirect_user] + # If an admin has clicked the confirmation link on a users behalf, + # we don’t want to reassign the request to the administrator. + @info_request.user = params[:post_redirect_user] + else + @info_request.user = authenticated_user + end # This automatically saves dependent objects, such as @outgoing_message, in the same transaction @info_request.save! # XXX send_message needs the database id, so we send after saving, which isn't ideal if the request broke here. diff --git a/spec/controllers/request_controller_spec.rb b/spec/controllers/request_controller_spec.rb index 93d3a2bbe..19938ac61 100644 --- a/spec/controllers/request_controller_spec.rb +++ b/spec/controllers/request_controller_spec.rb @@ -637,7 +637,7 @@ describe RequestController, "when creating a new request" do it "should accept a public body parameter" do get :new, :public_body_id => @body.id - assigns[:info_request].public_body.should == @body + assigns[:info_request].public_body.should == @body response.should render_template('new') end diff --git a/spec/integration/create_request_spec.rb b/spec/integration/create_request_spec.rb new file mode 100644 index 000000000..6f336d406 --- /dev/null +++ b/spec/integration/create_request_spec.rb @@ -0,0 +1,44 @@ +require File.expand_path(File.dirname(__FILE__) + '/../spec_helper') + +describe "When creating requests" do + it "should associate the request with the requestor, even if it is approved by an admin" do + # This is a test for https://github.com/sebbacon/alaveteli/issues/446 + + params = { :info_request => { :public_body_id => public_bodies(:geraldine_public_body).id, + :title => "Why is your quango called Geraldine?", :tag_string => "" }, + :outgoing_message => { :body => "This is a silly letter. It is too short to be interesting." }, + :submitted_new_request => 1, :preview => 0 + } + + # Initially we are not logged in. Try to create a new request. + post "/new", params + # We expect to be redirected to the login page + post_redirect = PostRedirect.get_last_post_redirect + response.should redirect_to(:controller => 'user', :action => 'signin', :token => post_redirect.token) + follow_redirect! + response.should render_template("user/sign") + + # Now log in as an unconfirmed user. + post "/profile/sign_in", :user_signin => {:email => users(:unconfirmed_user).email, :password => "jonespassword"}, :token => post_redirect.token + # This will trigger a confirmation mail. Get the PostRedirect for later. + response.should render_template("user/confirm") + post_redirect = PostRedirect.get_last_post_redirect + + # Now log in as an admin user, then follow the confirmation link in the email that was sent to the unconfirmed user + admin_user = users(:admin_user) + admin_user.email_confirmed = true + admin_user.save! + post_via_redirect "/profile/sign_in", :user_signin => {:email => admin_user.email, :password => "jonespassword"} + response.should be_success + get "/c/" + post_redirect.email_token + follow_redirect! + response.location.should =~ %r(/request/(.+)/new) + response.location =~ %r(/request/(.+)/new) + url_title = $1 + info_request = InfoRequest.find_by_url_title(url_title) + info_request.should_not be_nil + + # Make sure the request is still owned by the user who made it, not the admin who confirmed it + info_request.user_id.should == users(:unconfirmed_user).id + end +end |