From 9bf2c8167722dfc6357c184b0aa08a3adf02f653 Mon Sep 17 00:00:00 2001
From: Julio Biason <julio.biason@gmail.com>
Date: Mon, 14 Apr 2014 21:44:59 -0300
Subject: [PATCH] cannot vote for groups that the user is not a member

---
 tests/vote_tests.py | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/tests/vote_tests.py b/tests/vote_tests.py
index 4e6c25b..0a39037 100644
--- a/tests/vote_tests.py
+++ b/tests/vote_tests.py
@@ -165,5 +165,24 @@ class TestVote(LunchoTests):
         self.assertJsonError(rv, 404, 'Group not found')
         return
 
+    def test_vote_in_group_not_member(self):
+        """Try to vote for a group that the user is not a member."""
+        group = self._group()
+        place = self._place()
+        group.places.append(place)
+        server.db.session.commit()
+
+        user2 = self.create_user(name='newUser',
+                                 fullname='new user',
+                                 verified=True,
+                                 create_token=True)
+
+        request = {'choices': [place.id]}
+        rv = self.post('/vote/{group_id}/'.format(group_id=group.id),
+                       request,
+                       token=user2.token)
+        self.assertJsonError(rv, 403, 'User is not member of this group')
+        return
+
 if __name__ == '__main__':
     unittest.main()