    it "updates a hostgroup with a parent parameter" do
      child = FactoryGirl.create(:hostgroup, :parent => @base)
      as_admin do
        assert_equal "original", child.parameters["x"]
      end
      post :update, {"id" => child.id, "hostgroup" => {"name" => child.name,
                                                       :group_parameters_attributes => {"0" => {:name => "x", :value =>"overridden", :_destroy => ""}}}}, set_session_user
      assert_redirected_to hostgroups_url
      child.reload
      assert_equal "overridden", child.parameters["x"]
    end
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.