From 4e8307fe7bd88b6cdd9840a94f8275354aae0bd8 Mon Sep 17 00:00:00 2001 From: Seb Bacon Date: Wed, 11 Jan 2012 09:11:18 +0000 Subject: Don't give an error to users with an invalid postredirect token. Closes #334. --- spec/controllers/user_controller_spec.rb | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'spec/controllers/user_controller_spec.rb') diff --git a/spec/controllers/user_controller_spec.rb b/spec/controllers/user_controller_spec.rb index c13d7c9fc..2560b48c7 100644 --- a/spec/controllers/user_controller_spec.rb +++ b/spec/controllers/user_controller_spec.rb @@ -109,6 +109,19 @@ describe UserController, "when signing in" do response.should_not send_email end + it "should not log you in if you use an invalid PostRedirect token, and shouldn't give 500 error either" do + ActionController::Routing::Routes.filters.clear + get :signin, :r => "/list" + response.should render_template('sign') + post_redirect = "something invalid" + lambda { + post :signin, { :user_signin => { :email => 'bob@localhost', :password => 'jonespassword' }, + :token => post_redirect + } + }.should_not raise_error(NoMethodError) + response.should render_template('sign') + end + # No idea how to test this in the test framework :( # it "should have set a long lived cookie if they picked remember me, session cookie if they didn't" do # get :signin, :r => "/list" -- cgit v1.2.3