Revision bd622a22
Added by Dominic Cleal about 8 years ago
| test/unit/user_test.rb | ||
|---|---|---|
|
user.timezone = ''
|
||
|
assert user.valid?
|
||
|
end
|
||
|
|
||
|
test '.to_label should return persisted name' do
|
||
|
user = users(:one)
|
||
|
user.firstname = 'First'
|
||
|
user.lastname = 'Last'
|
||
|
refute_equal('First Last', user.to_label, 'User to_label should not change until saved')
|
||
|
user.save
|
||
|
assert_equal('First Last', user.to_label, 'User to_label should change after saved')
|
||
|
end
|
||
|
end
|
||
Also available in: Unified diff
refs #14691 - user editing self should not change User.current
Rather than changing the behaviour of #to_label to return persisted
data, the User.current object should not be modified with unsaved data
from the form submission or API update.
User.current is used for authz as well as for display purposes, so
shouldn't be changed. Parameter filtering protects privilege escalation
in this case.