Preventing users to directly call unauthorized actions

Regarding to ownership

Preventing users to directly call unauthorized actions
Regarding to ownership
Rafael Manzo · Rafael Manzo
1 parent 2976a8f6
Showing 3 changed files with 25 additions and 13 deletions Show diff stats
app/controllers/projects_controller.rb
features/project/edition.feature
spec/controllers/projects_controller_spec.rb
 class ProjectsController < ApplicationController
   before_action :authenticate_user!,
     except: [:index, :show]
+  before_action :check_ownership, only: [:edit, :update, :destroy]
   # GET /projects/new
   def new
@@ -39,14 +40,7 @@ class ProjectsController &lt; ApplicationController
   # GET /projects/1/edit
   # GET /projects/1/edit.json
   def edit
-    if current_user.project_ownerships.find_by_project_id(params[:id]).nil?
-      respond_to do |format|
-        format.html { redirect_to projects_url, notice: "You shall not edit projects that aren't yours." }
-        format.json { head :no_content }
-      end
-    else
-      set_project
-    end
+    set_project
   end 
   def update
@@ -81,4 +75,13 @@ class ProjectsController &lt; ApplicationController
       params[:project]
     end
+    def check_ownership
+      if current_user.project_ownerships.find_by_project_id(params[:id]).nil?
+        respond_to do |format|
+          format.html { redirect_to projects_url, notice: "You're not allowed to do this operation" }
+          format.json { head :no_content }
+        end
+      end
+    end
+
 end
@@ -27,7 +27,7 @@ Feature: Project
     And I have a sample project
     And I am at the All Projects page
     When I visit the sample project edit page
-    Then I should see You shall not edit
+    Then I should see You're not allowed to do this operation
   @kalibro_restart
   Scenario: Filling up the form
@@ -72,7 +72,7 @@ describe ProjectsController do
     it { should render_template(:show) }
   end
-  describe 'delete' do
+  describe 'destroy' do
     before :each do
       sign_in FactoryGirl.create(:user)
@@ -82,8 +82,12 @@ describe ProjectsController do
       @ownership = FactoryGirl.build(:project_ownership)
       @ownership.expects(:destroy)
       @ownerships = []
+
+      #Those two mocks looks the same but they are necessary since params[:id] is a String and @project.id is an Integer :(
+      @ownerships.expects(:find_by_project_id).with("#{@subject.id}").returns(@ownership)
       @ownerships.expects(:find_by_project_id).with(@subject.id).returns(@ownership)
-      User.any_instance.expects(:project_ownerships).returns(@ownerships)
+
+      User.any_instance.expects(:project_ownerships).at_least_once.returns(@ownerships)
       Project.expects(:find).with(@subject.id.to_s).returns(@subject)
       delete :destroy, :id => @subject.id
@@ -136,7 +140,7 @@ describe ProjectsController do
       end
       it { should redirect_to(projects_path)  }
-      
+
       it 'should set the flash' do
         pending("This ShouldaMatcher test is not compatible yet with Rails 4") do
           should set_the_flash[:notice].to("You shall not edit projects that aren't yours.")
@@ -147,7 +151,8 @@ describe ProjectsController do
   describe 'update' do
     before do
-      sign_in FactoryGirl.create(:user)
+      @user = FactoryGirl.create(:user)
+      sign_in @user
     end
     context 'with valid fields' do
@@ -155,6 +160,8 @@ describe ProjectsController do
         @subject = FactoryGirl.build(:project)
         @subject_params = Hash[FactoryGirl.attributes_for(:project).map { |k,v| [k.to_s, v.to_s] }] #FIXME: Mocha is creating the expectations with strings, but FactoryGirl returns everything with sybols and integers
+        FactoryGirl.create(:project_ownership, {user_id: @user.id, project_id: @subject.id})
+
         Project.expects(:find).with(@subject.id.to_s).returns(@subject)
         Project.any_instance.expects(:update).with(@subject_params).returns(true)
       end
@@ -185,6 +192,8 @@ describe ProjectsController do
         @subject = FactoryGirl.build(:project)
         @subject_params = Hash[FactoryGirl.attributes_for(:project).map { |k,v| [k.to_s, v.to_s] }] #FIXME: Mocha is creating the expectations with strings, but FactoryGirl returns everything with sybols and integers
+        FactoryGirl.create(:project_ownership, {user_id: @user.id, project_id: @subject.id})
+
         Project.expects(:find).with(@subject.id.to_s).returns(@subject)
         Project.any_instance.expects(:update).with(@subject_params).returns(false)
	@@ -27,7 +27,7 @@ Feature: Project		@@ -27,7 +27,7 @@ Feature: Project
27	And I have a sample project	27	And I have a sample project
28	And I am at the All Projects page	28	And I am at the All Projects page
29	When I visit the sample project edit page	29	When I visit the sample project edit page
30	- Then I should see You shall not edit	30	+ Then I should see You're not allowed to do this operation
31		31
32	@kalibro_restart	32	@kalibro_restart
33	Scenario: Filling up the form	33	Scenario: Filling up the form