Force the account ID value during update so it can't be changed

(and so it's also available in the field validators) Fixes #15
adamlundrigan · Aug 13, 2014 · 98c2c13 · 98c2c13
1 parent f234fff
commit 98c2c13
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 3 deletions.
diff --git a/src/LdcUserProfile/Controller/ProfileController.php b/src/LdcUserProfile/Controller/ProfileController.php
@@ -46,6 +46,9 @@ public function indexAction()
 
         $fm = $this->flashMessenger()->setNamespace('ldc-user-profile');
 
+        // Ensure that the user can't change the account ID during update
+        $prg['zfcuser']['id'] = $this->zfcUserAuthentication()->getIdentity()->getId();
+
         $form->setData($prg);
         if ( ! $form->isValid() ) {
             $fm->addErrorMessage('One or more of the values you provided is invalid.');

diff --git a/tests/LdcUserProfileTest/Controller/ProfileControllerTest.php b/tests/LdcUserProfileTest/Controller/ProfileControllerTest.php
@@ -23,6 +23,7 @@ class ProfileControllerTest extends \PHPUnit_Framework_TestCase
     public function setUp()
     {
         $this->mockUserEntity = new \ZfcUser\Entity\User();
+        $this->mockUserEntity->setId(42);
 
         $this->mockUserService = \Mockery::mock('ZfcUser\Service\User');
 
@@ -105,7 +106,8 @@ public function testControllerDispatchedWithValidFormDataWillCompleteAndRedirect
 
         $req = $this->controller->getRequest();
         $req->setMethod(Request::METHOD_POST);
-        $req->getPost()->set('foo', 'bar');
+        $req->getPost()->set('foo', ['bar' => 'baz']);
+        $req->getPost()->set('zfcuser', ['id' => 42]);
 
         $postData = $req->getPost()->toArray();
         $mockResult = new \stdClass();
@@ -133,7 +135,8 @@ public function testControllerDispatchedWithInvalidFormDataWillRenderForm()
 
         $req = $this->controller->getRequest();
         $req->setMethod(Request::METHOD_POST);
-        $req->getPost()->set('foo', 'bar');
+        $req->getPost()->set('foo', ['bar' => 'baz']);
+        $req->getPost()->set('zfcuser', ['id' => 42]);
 
         $postData = $req->getPost()->toArray();
         $mockResult = new \stdClass();
@@ -159,7 +162,8 @@ public function testControllerWillRenderFormWhenSaveCallFails()
 
         $req = $this->controller->getRequest();
         $req->setMethod(Request::METHOD_POST);
-        $req->getPost()->set('foo', 'bar');
+        $req->getPost()->set('foo', ['bar' => 'baz']);
+        $req->getPost()->set('zfcuser', ['id' => 42]);
 
         $postData = $req->getPost()->toArray();
         $mockResult = new \stdClass();