cst1/openstreetmap-website
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Require integer IDs for diary_entries#show

Browse source 
Fixes #3865
This commit is contained in:
Tom Hughes 2022-12-29 17:14:05 +00:00
parent df4f0b93d7
commit 27e9965dd2
2 changed files with 6 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
config/routes.rb
View file

@ -226,7 +226,7 @@ OpenStreetMap::Application.routes.draw do
get "/user/:display_name/diary" => "diary_entries#index"
get "/diary/:language" => "diary_entries#index"
scope "/user/:display_name" do
resources :diary_entries, :path => "diary", :only => [:edit, :update, :show]
resources :diary_entries, :path => "diary", :only => [:edit, :update, :show], :id => /\d+/
end
post "/user/:display_name/diary/:id/newcomment" => "diary_entries#comment", :id => /\d+/, :as => :comment_diary_entry
post "/user/:display_name/diary/:id/hide" => "diary_entries#hide", :id => /\d+/, :as => :hide_diary_entry

5
test/controllers/diary_entries_controller_test.rb
View file

@ -669,6 +669,11 @@ class DiaryEntriesControllerTest < ActionDispatch::IntegrationTest
assert_response :success
assert_template :show
# Try a non-integer ID
assert_raise ActionController::RoutingError do
get "/user/#{CGI.escapeURIComponent(user.display_name)}/diary/#{diary_entry.id})"
end
# Try a deleted entry
diary_entry_deleted = create(:diary_entry, :user => user, :visible => false)
get diary_entry_path(:display_name => user.display_name, :id => diary_entry_deleted)