From bee28e1785ad7844bd518c19106beee7d8a4c560 Mon Sep 17 00:00:00 2001
From: Douglas Barbosa Alexandre <dbalexandre@gmail.com>
Date: Mon, 11 Apr 2016 18:57:18 -0300
Subject: [PATCH] Requires user to be signed in when changing notification
 settings

---
 .../notification_settings_controller.rb       |  2 ++
 .../notification_settings_controller.rb       |  2 ++
 .../notification_settings_controller_spec.rb  | 17 ++++++++++
 .../notification_settings_controller_spec.rb  | 31 +++++++++++++++++++
 4 files changed, 52 insertions(+)
 create mode 100644 spec/controllers/groups/notification_settings_controller_spec.rb
 create mode 100644 spec/controllers/projects/notification_settings_controller_spec.rb

diff --git a/app/controllers/groups/notification_settings_controller.rb b/app/controllers/groups/notification_settings_controller.rb
index 1b46f26a37..de13b16ccf 100644
--- a/app/controllers/groups/notification_settings_controller.rb
+++ b/app/controllers/groups/notification_settings_controller.rb
@@ -1,4 +1,6 @@
 class Groups::NotificationSettingsController < Groups::ApplicationController
+  before_action :authenticate_user!
+
   def update
     notification_setting = current_user.notification_settings_for(group)
     saved = notification_setting.update_attributes(notification_setting_params)
diff --git a/app/controllers/projects/notification_settings_controller.rb b/app/controllers/projects/notification_settings_controller.rb
index 90d294a462..e536725c5b 100644
--- a/app/controllers/projects/notification_settings_controller.rb
+++ b/app/controllers/projects/notification_settings_controller.rb
@@ -1,4 +1,6 @@
 class Projects::NotificationSettingsController < Projects::ApplicationController
+  before_action :authenticate_user!
+
   def create
     notification_setting = current_user.notification_settings_for(project)
     saved = notification_setting.update_attributes(notification_setting_params)
diff --git a/spec/controllers/groups/notification_settings_controller_spec.rb b/spec/controllers/groups/notification_settings_controller_spec.rb
new file mode 100644
index 0000000000..3572535d61
--- /dev/null
+++ b/spec/controllers/groups/notification_settings_controller_spec.rb
@@ -0,0 +1,17 @@
+require 'spec_helper'
+
+describe Groups::NotificationSettingsController do
+  let(:group) { create(:group) }
+
+  describe '#update' do
+    context 'when not authorized' do
+      it 'redirects to sign in page' do
+        put :update,
+            group_id: group.to_param,
+            notification_setting: { level: NotificationSetting.levels[:participating] }
+
+        expect(response).to redirect_to(new_user_session_path)
+      end
+    end
+  end
+end
diff --git a/spec/controllers/projects/notification_settings_controller_spec.rb b/spec/controllers/projects/notification_settings_controller_spec.rb
new file mode 100644
index 0000000000..7e32a75b81
--- /dev/null
+++ b/spec/controllers/projects/notification_settings_controller_spec.rb
@@ -0,0 +1,31 @@
+require 'spec_helper'
+
+describe Projects::NotificationSettingsController do
+  let(:project) { create(:empty_project) }
+
+  describe '#create' do
+    context 'when not authorized' do
+      it 'redirects to sign in page' do
+        post :create,
+             namespace_id: project.namespace.to_param,
+             project_id: project.to_param,
+             notification_setting: { level: NotificationSetting.levels[:participating] }
+
+        expect(response).to redirect_to(new_user_session_path)
+      end
+    end
+  end
+
+  describe '#update' do
+    context 'when not authorized' do
+      it 'redirects to sign in page' do
+        put :update,
+            namespace_id: project.namespace.to_param,
+            project_id: project.to_param,
+            notification_setting: { level: NotificationSetting.levels[:participating] }
+
+        expect(response).to redirect_to(new_user_session_path)
+      end
+    end
+  end
+end