Check referer on holds/result (#292)

psu-libraries · Oct 27, 2020 · d6147aa · d6147aa
1 parent 12e6a7d
commit d6147aa
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 8 deletions.
diff --git a/app/controllers/holds_controller.rb b/app/controllers/holds_controller.rb
@@ -7,7 +7,6 @@ class HoldsController < ApplicationController
   before_action :unless_maintenance_mode, only: :new
   rescue_from NewHoldException, with: :deny_new
   rescue_from HoldCreateException, with: :deny_create
-  rescue_from HoldException, with: :past_date
 
   # Render patron holds
   #
@@ -73,7 +72,11 @@ def create
   #
   # GET /holds/result
   def result
-    render
+    if request.referer && URI(request.referer).path == '/holds/new'
+      render
+    else
+      redirect_to '/not_found'
+    end
   end
 
   # Handles form submission for canceling holds in Symphony

diff --git a/app/models/hold_exception.rb b/app/models/hold_exception.rb
diff --git a/spec/controllers/holds_controller_spec.rb b/spec/controllers/holds_controller_spec.rb
@@ -196,10 +196,12 @@
     end
 
     describe '#result' do
-      it 'renders the result template' do
-        get :result
+      context 'when not redirected from /holds/new' do
+        it 'redirects to the summary page' do
+          get :result
 
-        expect(response).to render_template(:result)
+          expect(response).to redirect_to '/not_found'
+        end
       end
     end