CristinaRO/otwarchive — comment on commit 0afd3cc3bcec7ef08cca50289924db36d257226d
File: app/controllers/users_controller.rb line 228
By shalott:

*WAVING ARMS URGENTLY* security/legal hole! This would allow anyone to create a new user completely without validation (eg without accepting terms of service, without invitation, duplicate email, etc) just by creating a form submission by hand and tacking validate=false on to it.

I'm closing the pull request so no one accidentally merges -- please take out before re-opening!

As far as I can see you're only doing this so you can test -- my advice is don't test this in the rspec via the controller -- rspecs are meant for unit testing anyway and should be focused on the model. Just create a duplicate user object manually and do a @user.save(:validate => false) there in the rspec and then check to see that User.where(:login => whatever).count still is just 1 afterwards.