Commit ba0bccbe authored by Steffen van Bergerem's avatar Steffen van Bergerem

Redirect conversations/new to conversations

parent 1a5bcec3
......@@ -84,7 +84,7 @@ class ConversationsController < ApplicationController
end
def new
if !params[:facebox] && session[:mobile_view] == false && request.format.html?
if !params[:facebox] && !session[:mobile_view] && request.format.html?
redirect_to conversations_path
return
end
......
......@@ -10,32 +10,39 @@ describe ConversationsController, :type => :controller do
end
describe '#new' do
it 'succeeds' do
it 'redirects to #index' do
get :new
expect(response).to redirect_to conversations_path
end
end
describe '#new facebox' do
it 'succeeds' do
get :new, :facebox => true
expect(response).to be_success
end
it "assigns a json list of contacts that are sharing with the person" do
get :new
get :new, :facebox => true
expect(assigns(:contacts_json)).to include(alice.contacts.where(:sharing => true).first.person.name)
alice.contacts << Contact.new(:person_id => eve.person.id, :user_id => alice.id, :sharing => false, :receiving => true)
expect(assigns(:contacts_json)).not_to include(alice.contacts.where(:sharing => false).first.person.name)
end
it "assigns a contact if passed a contact id" do
get :new, :contact_id => alice.contacts.first.id
get :new, :contact_id => alice.contacts.first.id, :facebox => true
expect(assigns(:contact_ids)).to eq(alice.contacts.first.id)
end
it "assigns a set of contacts if passed an aspect id" do
get :new, :aspect_id => alice.aspects.first.id
get :new, :aspect_id => alice.aspects.first.id, :facebox => true
expect(assigns(:contact_ids)).to eq(alice.aspects.first.contacts.map(&:id).join(','))
end
it "does not allow XSS via the name parameter" do
["</script><script>alert(1);</script>",
'"}]});alert(1);(function f() {var foo = [{b:"'].each do |xss|
get :new, name: xss
get :new, :facebox => true, name: xss
expect(response.body).not_to include xss
end
end
......@@ -44,7 +51,7 @@ describe ConversationsController, :type => :controller do
xss = "<script>alert(0);</script>"
contact = alice.contacts.first
contact.person.profile.update_attribute(:first_name, xss)
get :new
get :new, :facebox => true
json = JSON.parse(assigns(:contacts_json)).first
expect(json['value'].to_s).to eq(contact.id.to_s)
expect(json['name']).to_not include(xss)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment