  def test_destroy
    auth_source_ldap = AuthSourceLdap.unscoped.first
    User.unscoped.where(:auth_source_id => auth_source_ldap.id).update_all(:auth_source_id => nil)
    delete :destroy, {:id => auth_source_ldap}, set_session_user
    assert_redirected_to auth_source_ldaps_url
    refute AuthSourceLdap.unscoped.exists?(auth_source_ldap.id)
  end
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.