  def setup_user(operation, type = "", search = nil, user = :one)
    @one = users(user)
    as_admin do
      permission = Permission.find_by_name("#{operation}_#{type}") || FactoryGirl.create(:permission, :name => "#{operation}_#{type}")
      filter = FactoryGirl.build(:filter, :search => search)
      filter.permissions = [ permission ]
      role = Role.where(:name => "#{operation}_#{type}").first_or_create
      role.filters = [ filter ]
      role.save!
      filter.role = role
      filter.save!
      @one.roles << role
      yield(@one) if block_given?
      @one.save!
    end
    User.current = @one
  end
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.