X-Git-Url: https://projects.mako.cc/source/selectricity/blobdiff_plain/aa6f2f886d78c6cf42ee284ded1ce3cd3db1c632..763b868a267099cde66e875ed7d78e01f8bb0cac:/test/functional/quickvote_controller_test.rb?ds=inline

diff --git a/test/functional/quickvote_controller_test.rb b/test/functional/quickvote_controller_test.rb
index a390d94..02c133e 100644
--- a/test/functional/quickvote_controller_test.rb
+++ b/test/functional/quickvote_controller_test.rb
@@ -100,4 +100,39 @@ class QuickvoteControllerTest < Test::Unit::TestCase
     post :confirm, { 'ident' => 'variable', 'rankings-list' => votes.sort_by {rand} }
     assert_template 'quickvote/thanks'
   end
+
+  def test_cast_dupe_quickvote
+    test_create_quickvote
+    votes = QuickVote.ident_to_quickvote('variable').candidates.collect { |c| c.id}
+    get :index, { 'ident' => 'variable' }
+    assert_response :success
+
+    post :confirm, { 'ident' => 'variable', 'rankings-list' => votes.sort_by {rand} }
+    assert_template 'quickvote/thanks'
+
+    get :index, { 'ident' => 'variable' }
+    assert_response :success
+    post :confirm, { 'ident' => 'variable', 'rankings-list' => votes.sort_by {rand} }
+    assert_redirected_to :controller => 'quickvote', :ident => 'variable'
+  end
+  def test_display_tainted_quickvote
+    test_create_quickvote
+    qv=QuickVote.ident_to_quickvote('variable')
+    qv.description="<object>foo</object>"
+    qv.candidatelist = ["<object>foo", "bar<object>", "<foobar>"]
+    qv.save!
+    get :index, { 'ident' => 'variable' }
+    assert_response :success
+    assert_no_tag :tag => "object"
+    assert_no_tag :tag => "foobar"
+    votes = QuickVote.ident_to_quickvote('variable').candidates.collect { |c| c.id}
+    post :confirm, { 'ident' => 'variable', 'rankings-list' => votes.sort_by {rand} }
+    assert_template('quickvote/thanks')
+    assert_no_tag :tag => "object"
+    assert_no_tag :tag => "foobar"
+    get :results, { 'ident' => 'variable' }
+    assert_response :success
+    assert_no_tag :tag => "object"
+    assert_no_tag :tag => "foobar"
+  end
 end