From 52e870c200e075405891638ebcd69dadc5aff94c Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Tue, 28 Apr 2026 19:29:03 +0100 Subject: [PATCH] Include deleted messages when checking the rate limit Reported-by: Jorge Gonzalez Milla --- app/controllers/messages_controller.rb | 2 +- test/controllers/messages_controller_test.rb | 20 +++++++++++++++++++- 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/app/controllers/messages_controller.rb b/app/controllers/messages_controller.rb index 2db2a9960..8edc14e28 100644 --- a/app/controllers/messages_controller.rb +++ b/app/controllers/messages_controller.rb @@ -45,7 +45,7 @@ class MessagesController < ApplicationController @message.sender = current_user @message.sent_on = Time.now.utc - if current_user.sent_messages.where(:sent_on => (Time.now.utc - 1.hour)..).count >= current_user.max_messages_per_hour + if Message.where(:sender => current_user, :sent_on => (Time.now.utc - 1.hour)..).count >= current_user.max_messages_per_hour flash.now[:error] = t ".limit_exceeded" render :action => "new" elsif @message.save diff --git a/test/controllers/messages_controller_test.rb b/test/controllers/messages_controller_test.rb index 0c16bb548..1a0d3cf4d 100644 --- a/test/controllers/messages_controller_test.rb +++ b/test/controllers/messages_controller_test.rb @@ -191,12 +191,30 @@ class MessagesControllerTest < ActionDispatch::IntegrationTest # Login as a normal user user = create(:user) recipient_user = create(:user) + message = create(:message, :unread, :sender => user, :recipient => recipient_user) session_for(user) # Check that sending a message fails when the message limit is hit assert_no_difference "ActionMailer::Base.deliveries.size" do assert_no_difference "Message.count" do - with_settings(:max_messages_per_hour => 0) do + with_settings(:max_messages_per_hour => 1) do + perform_enqueued_jobs do + post messages_path(:display_name => recipient_user.display_name, + :message => { :title => "Test Message", :body => "Test message body" }) + assert_response :success + assert_template "new" + assert_select ".alert.alert-danger", /wait a while/ + end + end + end + end + + message.update(:from_user_visible => false) + + # Check that sending a message still fails when message is deleted + assert_no_difference "ActionMailer::Base.deliveries.size" do + assert_no_difference "Message.count" do + with_settings(:max_messages_per_hour => 1) do perform_enqueued_jobs do post messages_path(:display_name => recipient_user.display_name, :message => { :title => "Test Message", :body => "Test message body" }) -- 2.47.3