From: Tom Hughes <tom@compton.nu>
Date: Tue, 11 Mar 2025 22:44:54 +0000 (+0000)
Subject: Fix error if no users are selected for a bulk update
X-Git-Tag: live~13^2~2
X-Git-Url: https://git.openstreetmap.org./rails.git/commitdiff_plain/56e9580de965ed3f2772a70c37bc80d4ab0a8779?ds=sidebyside;hp=-c

Fix error if no users are selected for a bulk update
---

56e9580de965ed3f2772a70c37bc80d4ab0a8779
diff --git a/app/controllers/users/lists_controller.rb b/app/controllers/users/lists_controller.rb
index 59d1bc541..2f4c4f5fb 100644
--- a/app/controllers/users/lists_controller.rb
+++ b/app/controllers/users/lists_controller.rb
@@ -33,7 +33,7 @@ module Users
     ##
     # update status of selected users
     def update
-      ids = params[:user].keys.collect(&:to_i)
+      ids = params.fetch(:user, {}).keys.collect(&:to_i)
 
       User.where(:id => ids).update_all(:status => "confirmed") if params[:confirm]
       User.where(:id => ids).update_all(:status => "deleted") if params[:hide]
diff --git a/test/controllers/users/lists_controller_test.rb b/test/controllers/users/lists_controller_test.rb
index 1bb0e86a2..2471b34b3 100644
--- a/test/controllers/users/lists_controller_test.rb
+++ b/test/controllers/users/lists_controller_test.rb
@@ -210,6 +210,14 @@ module Users
 
       session_for(create(:administrator_user))
 
+      # Should do nothing when no users selected
+      assert_no_difference "User.active.count" do
+        put users_list_path, :params => { :confirm => 1 }
+      end
+      assert_redirected_to :action => :show
+      assert_equal "pending", inactive_user.reload.status
+      assert_equal "suspended", suspended_user.reload.status
+
       # Should work when logged in as an administrator
       assert_difference "User.active.count", 2 do
         put users_list_path, :params => { :confirm => 1, :user => { inactive_user.id => 1, suspended_user.id => 1 } }
@@ -254,6 +262,14 @@ module Users
 
       session_for(create(:administrator_user))
 
+      # Should do nothing when no users selected
+      assert_no_difference "User.active.count" do
+        put users_list_path, :params => { :hide => 1 }
+      end
+      assert_redirected_to :action => :show
+      assert_equal "active", normal_user.reload.status
+      assert_equal "confirmed", confirmed_user.reload.status
+
       # Should work when logged in as an administrator
       assert_difference "User.active.count", -2 do
         put users_list_path, :params => { :hide => 1, :user => { normal_user.id => 1, confirmed_user.id => 1 } }