diff --git a/app/controllers/conversations_controller.rb b/app/controllers/conversations_controller.rb index 5713a2af5..7a175d315 100644 --- a/app/controllers/conversations_controller.rb +++ b/app/controllers/conversations_controller.rb @@ -84,7 +84,7 @@ class ConversationsController < ApplicationController end def new - if !params[:facebox] && session[:mobile_view] == false && request.format.html? + if !params[:facebox] && !session[:mobile_view] && request.format.html? redirect_to conversations_path return end diff --git a/spec/controllers/conversations_controller_spec.rb b/spec/controllers/conversations_controller_spec.rb index 3447f09e7..60f363e93 100644 --- a/spec/controllers/conversations_controller_spec.rb +++ b/spec/controllers/conversations_controller_spec.rb @@ -10,32 +10,39 @@ describe ConversationsController, :type => :controller do end describe '#new' do - it 'succeeds' do + it 'redirects to #index' do get :new + expect(response).to redirect_to conversations_path + end + end + + describe '#new facebox' do + it 'succeeds' do + get :new, :facebox => true expect(response).to be_success end it "assigns a json list of contacts that are sharing with the person" do - get :new + get :new, :facebox => true expect(assigns(:contacts_json)).to include(alice.contacts.where(:sharing => true).first.person.name) alice.contacts << Contact.new(:person_id => eve.person.id, :user_id => alice.id, :sharing => false, :receiving => true) expect(assigns(:contacts_json)).not_to include(alice.contacts.where(:sharing => false).first.person.name) end it "assigns a contact if passed a contact id" do - get :new, :contact_id => alice.contacts.first.id + get :new, :contact_id => alice.contacts.first.id, :facebox => true expect(assigns(:contact_ids)).to eq(alice.contacts.first.id) end it "assigns a set of contacts if passed an aspect id" do - get :new, :aspect_id => alice.aspects.first.id + get :new, :aspect_id => alice.aspects.first.id, :facebox => true expect(assigns(:contact_ids)).to eq(alice.aspects.first.contacts.map(&:id).join(',')) end it "does not allow XSS via the name parameter" do ["", '"}]});alert(1);(function f() {var foo = [{b:"'].each do |xss| - get :new, name: xss + get :new, :facebox => true, name: xss expect(response.body).not_to include xss end end @@ -44,7 +51,7 @@ describe ConversationsController, :type => :controller do xss = "" contact = alice.contacts.first contact.person.profile.update_attribute(:first_name, xss) - get :new + get :new, :facebox => true json = JSON.parse(assigns(:contacts_json)).first expect(json['value'].to_s).to eq(contact.id.to_s) expect(json['name']).to_not include(xss)