Merge pull request #15356 from snipe/validate_location_parent

Fixed #15341 - validate parent ID

Author: snipe

app/Models/Location.php

@@ -33,7 +33,7 @@ class Location extends SnipeModel
         'country'       => 'min:2|max:191|nullable',
         'zip'           => 'max:10|nullable',
         'manager_id'    => 'exists:users,id|nullable',
-        'parent_id'     => 'non_circular:locations,id',
+        'parent_id'     => 'nullable|exists:locations,id|non_circular:locations,id',
     ];
 
     protected $casts = [

tests/Feature/Locations/Ui/CreateLocationsTest.php

@@ -32,6 +32,20 @@ public function testUserCanCreateLocations()
 
         $this->assertTrue(Location::where('name', 'Test Location')->exists());
     }
-    
+
+    public function testUserCannotCreateLocationsWithInvalidParent()
+    {
+        $this->assertFalse(Location::where('name', 'Test Location')->exists());
+
+        $this->actingAs(User::factory()->superuser()->create())
+            ->from(route('locations.create'))
+            ->post(route('locations.store'), [
+                'name' => 'Test Location',
+                'parent_id' => '100000000'
+            ])
+            ->assertRedirect(route('locations.create'));
+
+        $this->assertFalse(Location::where('name', 'Test Location')->exists());
+    }
 
 }

tests/Feature/Locations/Ui/UpdateLocationsTest.php

@@ -52,6 +52,21 @@ public function testUserCannotEditLocationsToMakeThemTheirOwnParent()
         $this->assertFalse(Location::where('name', 'Test Location')->exists());
     }
 
+    public function testUserCannotEditLocationsWithInvalidParent()
+    {
+        $location = Location::factory()->create();
+        $response = $this->actingAs(User::factory()->superuser()->create())
+            ->from(route('locations.edit', ['location' => $location->id]))
+            ->put(route('locations.update', ['location' => $location]), [
+                'name' => 'Test Location',
+                'parent_id' => '100000000'
+            ])
+            ->assertRedirect(route('locations.edit', ['location' => $location->id]));
+
+        $this->followRedirects($response)->assertSee(trans('general.error'));
+        $this->assertFalse(Location::where('name', 'Test Location')->exists());
+    }
+
 
 
 }