Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix query params being clobbered by Clearance::BackDoor #1041

Merged
merged 1 commit into from
Nov 14, 2024
Merged

Fix query params being clobbered by Clearance::BackDoor #1041

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion lib/clearance/back_door.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,6 @@ def sign_in_through_the_back_door(env)
if user_param.present?
query_string = Rack::Utils.build_query(params)
env[Rack::QUERY_STRING] = query_string
env[Rack::RACK_REQUEST_QUERY_STRING] = query_string
user = find_user(user_param)
env[:clearance].sign_in(user)
end
Expand Down
2 changes: 1 addition & 1 deletion spec/dummy/app/controllers/application_controller.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,6 @@ class ApplicationController < ActionController::Base
include Clearance::Controller

def show
render inline: "Hello user #<%= current_user.id %>", layout: false
render inline: "Hello user #<%= current_user.id %> #{params.to_json}", layout: false
end
end
8 changes: 8 additions & 0 deletions spec/requests/backdoor_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,4 +8,12 @@

expect(cookies["remember_token"]).to eq user.remember_token
end

it "removes the `as` param but leaves other parameters unchanged" do
user = create(:user)

get root_path(as: user.to_param, foo: 'bar')

expect(response.body).to include('{"foo":"bar","controller":"application","action":"show"}')
end
end