Commit f38e7934 authored by edavis10's avatar edavis10
Browse files

Verify issues are updated by HTTP PUT only. Regression from r3486.

git-svn-id: https://svn.redmine.org/redmine/trunk@3520 e93f8b46-1217-0410-a6f0-8f06a7374b81
parent 0b8f9b26
......@@ -50,7 +50,9 @@ class IssuesController < ApplicationController
verify :method => [:post, :delete],
:only => :destroy,
:render => { :nothing => true, :status => :method_not_allowed }
verify :method => :put, :only => :update, :render => {:nothing => true, :status => :method_not_allowed }
def index
retrieve_query
sort_init(@query.sort_criteria.empty? ? [['id', 'desc']] : @query.sort_criteria)
......
......@@ -657,6 +657,20 @@ class IssuesControllerTest < ActionController::TestCase
assert_select_rjs :show, "update"
end
def test_update_using_invalid_http_verbs
@request.session[:user_id] = 2
subject = 'Updated by an invalid http verb'
get :update, :id => 1, :issue => {:subject => subject}
assert_not_equal subject, Issue.find(1).subject
post :update, :id => 1, :issue => {:subject => subject}
assert_not_equal subject, Issue.find(1).subject
delete :update, :id => 1, :issue => {:subject => subject}
assert_not_equal subject, Issue.find(1).subject
end
def test_put_update_without_custom_fields_param
@request.session[:user_id] = 2
ActionMailer::Base.deliveries.clear
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment