Verify HTTP method on ProjectsController#create.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@4646 e93f8b46-1217-0410-a6f0-8f06a7374b81

Verify HTTP method on ProjectsController#create.
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@4646 e93f8b46-1217-0410-a6f0-8f06a7374b81
072c4ad1 · Jean-Philippe Lang · 9fb770ba · 072c4ad1 · 072c4ad1
Commit 072c4ad1 authored Jan 06, 2011 by Jean-Philippe Lang
Hide whitespace changes
Inline Side-by-side

Showing with 14 additions and 3 deletions

projects_controller.rb app/controllers/projects_controller.rb +3 -3

projects_controller_test.rb test/functional/projects_controller_test.rb +11 -0

No files found.
--- a/app/controllers/projects_controller.rb
+++ b/app/controllers/projects_controller.rb
@@ -32,9 +32,6 @@ class ProjectsController < ApplicationController
    end
  end

-  # TODO: convert to PUT only
-  verify :method => [:post, :put], :only => :update, :render => {:nothing => true, :status => :method_not_allowed }
-
  helper :sort
  include SortHelper
  helper :custom_fields
@@ -71,6 +68,7 @@ class ProjectsController < ApplicationController
    @project = Project.new(params[:project])
  end

+  verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
  def create
    @issue_custom_fields = IssueCustomField.find(:all, :order => "#{CustomField.table_name}.position")
    @trackers = Tracker.all
@@ -183,6 +181,8 @@ class ProjectsController < ApplicationController
  def edit
  end

+  # TODO: convert to PUT only
+  verify :method => [:post, :put], :only => :update, :render => {:nothing => true, :status => :method_not_allowed }
  def update
    @project.safe_attributes = params[:project]
    if validate_parent_id && @project.save

--- a/test/functional/projects_controller_test.rb
+++ b/test/functional/projects_controller_test.rb
@@ -288,6 +288,17 @@ class ProjectsControllerTest < ActionController::TestCase
    end
  end
  
+  context "GET :create" do
+    setup do
+      @request.session[:user_id] = 1
+    end
+    
+    should "not be allowed" do
+      get :create
+      assert_response :method_not_allowed
+    end
+  end
+  
  def test_show_by_id
    get :show, :id => 1
    assert_response :success