From 000b14b71c9dfb7b545240d8ca7ac19cae424a99 Mon Sep 17 00:00:00 2001 From: Seb Bacon Date: Tue, 26 Jul 2011 17:19:14 +0100 Subject: Authentication should only apply to admin interface when *both* email *and* password are unset --- spec/controllers/admin_public_body_controller_spec.rb | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'spec/controllers/admin_public_body_controller_spec.rb') diff --git a/spec/controllers/admin_public_body_controller_spec.rb b/spec/controllers/admin_public_body_controller_spec.rb index cb622dabd..3a768686d 100644 --- a/spec/controllers/admin_public_body_controller_spec.rb +++ b/spec/controllers/admin_public_body_controller_spec.rb @@ -65,6 +65,15 @@ describe AdminPublicBodyController, "when administering public bodies" do post :destroy, { :id => 3 } PublicBody.count.should == 1 end + it "when no username set, skip admin authorisation" do + config = MySociety::Config.load_default() + config['ADMIN_USERNAME'] = '' + config['ADMIN_PASSWORD'] = 'fuz' + @request.env["HTTP_AUTHORIZATION"] = "" + PublicBody.count.should == 2 + post :destroy, { :id => 3 } + PublicBody.count.should == 1 + end end -- cgit v1.2.3