CVE-2013-7224

@@ -147,6 +147,14 @@ def group_ids=(value)
     super(value)
   end
 
+  def to_json(options = nil)
+    [name].to_json
+  end
+
+  def to_xml(options = nil)
+    [name].to_xml
+  end
+
   private
 
   # Suspend newly created user if signup requires an approval.

@@ -137,7 +137,7 @@
     end
   end
 
-  resources :users, :id => /\d+/ do
+  resources :users, :id => /\d+/, :except => [:index, :destroy] do
     member do
       get :avatar
       get :password

@@ -209,4 +209,18 @@
       @user.single_access_token.should == "token"
     end
   end
+
+  describe "serialization" do
+
+    let(:user) { FactoryGirl.build(:user) }
+
+    it "to json" do
+      expect(user.to_json).to eql([user.name].to_json)
+    end
+
+    it "to xml" do
+      expect(user.to_xml).to eql([user.name].to_xml)
+    end
+
+  end
 end

@@ -8,8 +8,8 @@
 describe UsersController do
   describe "routing" do
 
-    it "recognizes and generates #index" do
-      { :get => "/users" }.should route_to(:controller => "users", :action => "index")
+    it "doesn't recognize #index" do
+      { :get => "/users" }.should_not be_routable
     end
 
     it "recognizes and generates #new as /signup" do
@@ -40,8 +40,8 @@
       { :put => "/opportunities/aaron" }.should_not be_routable
     end
 
-    it "recognizes and generates #destroy" do
-      { :delete => "/users/1" }.should route_to(:controller => "users", :action => "destroy", :id => "1")
+    it "doesn't recognize #destroy" do
+      { :delete => "/users/1" }.should_not be_routable
     end
 
     it "doesn't recognize #destroy with non-numeric id" do
@@ -81,4 +81,3 @@
     end
   end
 end
-