diff --git a/app/views/imports/_pdf_import.html.erb b/app/views/imports/_pdf_import.html.erb index 421eed656..884cbecce 100644 --- a/app/views/imports/_pdf_import.html.erb +++ b/app/views/imports/_pdf_import.html.erb @@ -40,9 +40,9 @@

<%= t("imports.pdf_import.select_account", default: "Import to Account") %>

<%= form_with model: import, url: import_path(import), method: :patch, class: "space-y-2" do |f| %> - <% accounts = Current.user.accessible_accounts.manual.alphabetically %> + <% accounts = Current.user.accessible_accounts.manual.alphabetically.pluck(:name, :id) %> <% if accounts.any? %> - <%= f.select :account_id, options_for_select(accounts.map { |a| [a.name, a.id] }, import.account_id), { include_blank: t("imports.pdf_import.select_account_placeholder", default: "Select an account...") }, class: "form-field__input" %> + <%= f.select :account_id, options_for_select(accounts, import.account_id), { include_blank: t("imports.pdf_import.select_account_placeholder", default: "Select an account...") }, class: "form-field__input" %> <% if import.account.nil? %>

<%= t("imports.pdf_import.select_account_hint", default: "Choose which account to import these transactions into.") %>

<% end %> diff --git a/test/controllers/imports_controller_test.rb b/test/controllers/imports_controller_test.rb index 1b48bd953..4689e4edf 100644 --- a/test/controllers/imports_controller_test.rb +++ b/test/controllers/imports_controller_test.rb @@ -363,4 +363,17 @@ class ImportsControllerTest < ActionDispatch::IntegrationTest assert_redirected_to imports_path end + + test "PDF import account select does not leak unshared family accounts (#1803)" do + sign_in users(:family_member) + pdf_import = imports(:pdf_with_rows) + + get import_url(pdf_import) + + assert_response :success + assert_select 'select[name="import[account_id]"] option', text: "Checking Account" + assert_select 'select[name="import[account_id]"] option', text: "Collectable Account", count: 0 + assert_select 'select[name="import[account_id]"] option', text: "IOU (personal debt to friend)", count: 0 + assert_select 'select[name="import[account_id]"] option', text: "Plaid Depository Account", count: 0 + end end