a1dert/lh-tickets-test — Issue #177: User can add request for user from another company
Author: a1dert
Created: 2011-11-30 11:51:28+00:00
State: open
Labels: resolved, tracker

Imported from lighthouse. Original ticket at: http://redtape.lighthouseapp.com/projects/59696/tickets/427. Created by Alexey Derkach - 2011-08-04T12:16:07Z

Steps to reproduce:
1. We have two companies – Azeroth Inc. and Aratak.
2. ID of admin from Azeroth – 2, from Aratak – 1.
3. Login to Azeroth company site as admin.
4. Go to Employees page.
5. Go to admin profile.
6. Press New expense (for example)
7. You can see URL is similar to – http://azeroth.articulateexpress.com/expenses/new?user_id=2
8. Replace 2 to 1 and reload page.
9. You can see that you fill expense for user from company Aratak.
10. Fill data and press Request.
11. Login to Aratak company.
12. Go to Expenses page and you can see new expense.

Expected: user can not add request for users from another companies.
Actual: request successfully added and saved.

Staging: 476-s

According to: [story 7180](https://tracker.anahoret.com/projects/44/stories/7180 "story 7180")