Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
discourse/spec/models/group_request_spec.rb

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

8 lines
216 B
Ruby
Raw Normal View History

SECURITY: Limit the character count of group membership requests (#19993) When creating a group membership request, there is no character limit on the 'reason' field. This can be potentially be used by an attacker to create enormous amount of data in the database. Co-authored-by: Ted Johansson <ted@discourse.org>
2023-01-25 06:50:33 -05:00
# frozen_string_literal: true
RSpec.describe GroupRequest do
it { is_expected.to belong_to :user }
it { is_expected.to belong_to :group }
DEV: Bump the limits on group request text fields Users submitting requests to join groups were not receiving errors when the character limit for the request was exceeded. This also affects the UX when admin-created group request templates are inserted into the request. This patch bumps the limits. - https://meta.discourse.org/t/group-membership-requests-suddenly-limited-to-274-characters/265127 - https://github.com/discourse/discourse/pull/19993
2023-05-16 10:07:56 -04:00
it { is_expected.to validate_length_of(:reason).is_at_most(5000) }
SECURITY: Limit the character count of group membership requests (#19993) When creating a group membership request, there is no character limit on the 'reason' field. This can be potentially be used by an attacker to create enormous amount of data in the database. Co-authored-by: Ted Johansson <ted@discourse.org>
2023-01-25 06:50:33 -05:00
end