jro_apps/redmine Commit - r8941:b3866b05c14b

0

test/integration/users_test.rb created 644 +29 0

@@ -0,0 +1,29
	1	# Redmine - project management software
	2	# Copyright (C) 2006-2012 Jean-Philippe Lang
	3	#
	4	# This program is free software; you can redistribute it and/or
	5	# modify it under the terms of the GNU General Public License
	6	# as published by the Free Software Foundation; either version 2
	7	# of the License, or (at your option) any later version.
	8	#
	9	# This program is distributed in the hope that it will be useful,
	10	# but WITHOUT ANY WARRANTY; without even the implied warranty of
	11	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	12	# GNU General Public License for more details.
	13	#
	14	# You should have received a copy of the GNU General Public License
	15	# along with this program; if not, write to the Free Software
	16	# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
	17
	18	require File.expand_path('../../test_helper', __FILE__)
	19
	20	class USersTest < ActionController::IntegrationTest
	21	fixtures :users
	22
	23	def test_destroy_should_not_accept_get_requests
	24	assert_no_difference 'User.count' do
	25	get '/users/destroy/2', {}, credentials('admin')
	26	assert_response 404
	27	end
	28	end
	29	end

0

app/controllers/attachments_controller.rb 0 -1

                 end
               end
-              verify :method => :delete, :only => :destroy
               def destroy
                 # Make sure association callbacks are called
                 @attachment.container.attachments.delete(@attachment)

0

app/controllers/auth_sources_controller.rb 0 -4

               before_filter :require_admin
-              # GETs should be safe (see http://www.w3.org/2001/tag/doc/whenToUseGet.html)
-              verify :method => :post, :only => [ :destroy, :create, :update ],
-                     :redirect_to => { :template => :index }
               def index
                 @auth_source_pages, @auth_sources = paginate auth_source_class.name.tableize, :per_page => 10
                 render "auth_sources/index"

0

app/controllers/boards_controller.rb 0 -3

                 @board = @project.boards.build(params[:board])
               end
-              verify :method => :post, :only => :create, :redirect_to => { :action => :index }
               def create
                 @board = @project.boards.build(params[:board])
                 if @board.save
               def edit
               end
-              verify :method => :put, :only => :update, :redirect_to => { :action => :index }
               def update
                 if @board.update_attributes(params[:board])
                   redirect_to_settings_in_projects
                 end
               end
-              verify :method => :delete, :only => :destroy, :redirect_to => { :action => :index }
               def destroy
                 @board.destroy
                 redirect_to_settings_in_projects

0

app/controllers/comments_controller.rb 0 -2

               before_filter :find_project_from_association
               before_filter :authorize
-              verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
               def create
                 raise Unauthorized unless @news.commentable?
                 redirect_to :controller => 'news', :action => 'show', :id => @news
               end
-              verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }
               def destroy
                 @news.comments.find(params[:comment_id]).destroy
                 redirect_to :controller => 'news', :action => 'show', :id => @news

0

app/controllers/enumerations_controller.rb 0 -1

                 end
               end
-              verify :method => :delete, :only => :destroy, :render => { :nothing => true, :status => :method_not_allowed }
               def destroy
                 if !@enumeration.in_use?
                   # No associated objects

0

app/controllers/issue_categories_controller.rb 0 -3

                 @category = @project.issue_categories.build(params[:issue_category])
               end
-              verify :method => :post, :only => :create
               def create
                 @category = @project.issue_categories.build(params[:issue_category])
                 if @category.save
               def edit
               end
-              verify :method => :put, :only => :update
               def update
                 if @category.update_attributes(params[:issue_category])
                   respond_to do |format|
                 end
               end
-              verify :method => :delete, :only => :destroy
               def destroy
                 @issue_count = @category.issues.size
                 if @issue_count == 0 || params[:todo] || api_request?

0

app/controllers/issue_relations_controller.rb 0 -2

                 end
               end
-              verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
               def create
                 @relation = IssueRelation.new(params[:relation])
                 @relation.issue_from = @issue
                 end
               end
-              verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }
               def destroy
                 raise Unauthorized unless @relation.deletable?
                 @relation.destroy

0

app/controllers/issue_statuses_controller.rb 0 -1

                 end
               end
-              verify :method => :delete, :only => :destroy, :redirect_to => { :action => :index }
               def destroy
                 IssueStatus.find(params[:id]).destroy
                 redirect_to :action => 'index'

0

app/controllers/issues_controller.rb 0 -5

               helper :gantt
               include Redmine::Export::PDF
-              verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
-              verify :method => :post, :only => :bulk_update, :render => {:nothing => true, :status => :method_not_allowed }
-              verify :method => :put, :only => :update, :render => {:nothing => true, :status => :method_not_allowed }
               def index
                 retrieve_query
                 sort_init(@query.sort_criteria.empty? ? [['id', 'desc']] : @query.sort_criteria)
                 end
               end
-              verify :method => :delete, :only => :destroy, :render => { :nothing => true, :status => :method_not_allowed }
               def destroy
                 @hours = TimeEntry.sum(:hours, :conditions => ['issue_id IN (?)', @issues]).to_f
                 if @hours > 0

0

app/controllers/mail_handler_controller.rb 0 -4

             class MailHandlerController < ActionController::Base
               before_filter :check_credential
-              verify :method => :post,
-                     :only => :index,
-                     :render => { :nothing => true, :status => 405 }
               # Submits an incoming email to MailHandler
               def index
                 options = params.dup

0

app/controllers/messages_controller.rb 0 -3

               before_filter :find_message, :except => [:new, :preview]
               before_filter :authorize, :except => [:preview, :edit, :destroy]
-              verify :method => :post, :only => [ :reply, :destroy ], :redirect_to => { :action => :show }
-              verify :xhr => true, :only => :quote
               helper :watchers
               helper :attachments
               include AttachmentsHelper

0

app/controllers/my_controller.rb 0 -3

                                   'right' => ['issuesreportedbyme']
                                }.freeze
-              verify :xhr => true,
-                     :only => [:add_block, :remove_block, :order_blocks]
               def index
                 page
                 render :action => 'page'

0

app/controllers/projects_controller.rb 0 -5

                 @project = Project.new(params[:project])
               end
-              verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
               def create
                 @issue_custom_fields = IssueCustomField.find(:all, :order => "#{CustomField.table_name}.position")
                 @trackers = Tracker.all
               def edit
               end
-              # TODO: convert to PUT only
-              verify :method => [:post, :put], :only => :update, :render => {:nothing => true, :status => :method_not_allowed }
               def update
                 @project.safe_attributes = params[:project]
                 if validate_parent_id && @project.save
                 end
               end
-              verify :method => :post, :only => :modules, :render => {:nothing => true, :status => :method_not_allowed }
               def modules
                 @project.enabled_module_names = params[:enabled_module_names]
                 flash[:notice] = l(:notice_successful_update)
                 redirect_to(url_for(:controller => 'admin', :action => 'projects', :status => params[:status]))
               end
-              verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }
               # Delete @project
               def destroy
                 @project_to_destroy = @project

0

app/controllers/queries_controller.rb 0 -3

                 build_query_from_params
               end
-              verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
               def create
                 @query = Query.new(params[:query])
                 @query.user = User.current
               def edit
               end
-              verify :method => :put, :only => :update, :render => {:nothing => true, :status => :method_not_allowed }
               def update
                 @query.attributes = params[:query]
                 @query.project = nil if params[:query_is_for_all]
                 end
               end
-              verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }
               def destroy
                 @query.destroy
                 redirect_to :controller => 'issues', :action => 'index', :project_id => @project, :set_filter => 1

0

app/controllers/roles_controller.rb 0 -1

                 end
               end
-              verify :method => :delete, :only => :destroy, :redirect_to => { :action => :index }
               def destroy
                 @role.destroy
                 redirect_to :action => 'index'

0

app/controllers/timelog_controller.rb 0 -3

                 @time_entry.attributes = params[:time_entry]
               end
-              verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
               def create
                 @time_entry ||= TimeEntry.new(:project => @project, :issue => @issue, :user => User.current, :spent_on => User.current.today)
                 @time_entry.attributes = params[:time_entry]
                 @time_entry.attributes = params[:time_entry]
               end
-              verify :method => :put, :only => :update, :render => {:nothing => true, :status => :method_not_allowed }
               def update
                 @time_entry.attributes = params[:time_entry]
                 redirect_back_or_default({:controller => 'timelog', :action => 'index', :project_id => @projects.first})
               end
-              verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }
               def destroy
                 @time_entries.each do |t|
                   begin

0

app/controllers/trackers_controller.rb 0 -1

                 render :action => 'edit'
               end
-              verify :method => :delete, :only => :destroy, :redirect_to => { :action => :index }
               def destroy
                 @tracker = Tracker.find(params[:id])
                 unless @tracker.issues.empty?

0

app/controllers/users_controller.rb 0 -5

                 @auth_sources = AuthSource.find(:all)
               end
-              verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
               def create
                 @user = User.new(:language => Setting.default_language, :mail_notification => Setting.default_notification_option)
                 @user.safe_attributes = params[:user]
                 @membership ||= Member.new
               end
-              verify :method => :put, :only => :update, :render => {:nothing => true, :status => :method_not_allowed }
               def update
                 @user.admin = params[:user][:admin] if params[:user][:admin]
                 @user.login = params[:user][:login] if params[:user][:login]
                 redirect_to :controller => 'users', :action => 'edit', :id => @user
               end
-              verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }
               def destroy
                 @user.destroy
                 respond_to do |format|
                 end
               end
-              verify :method => [:post, :put], :only => :edit_membership, :render => {:nothing => true, :status => :method_not_allowed }
               def edit_membership
                 @membership = Member.edit_membership(params[:membership_id], params[:membership], @user)
                 @membership.save
                 end
               end
-              verify :method => :delete, :only => :destroy_membership, :render => {:nothing => true, :status => :method_not_allowed }
               def destroy_membership
                 @membership = Member.find(params[:membership_id])
                 if @membership.deletable?

0

app/controllers/versions_controller.rb 0 -1

                 redirect_to :controller => 'projects', :action => 'settings', :tab => 'versions', :id => @project
               end
-              verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }
               def destroy
                 if @version.fixed_issues.empty?
                   @version.destroy

0

app/controllers/watchers_controller.rb 0 -4

               before_filter :require_login, :check_project_privacy, :only => [:watch, :unwatch]
               before_filter :authorize, :only => [:new, :destroy]
-              verify :method => :post,
-                     :only => [ :watch, :unwatch ],
-                     :render => { :nothing => true, :status => :method_not_allowed }
               def watch
                 if @watched.respond_to?(:visible?) && !@watched.visible?(User.current)
                   render_403

0

app/controllers/wiki_controller.rb 0 -3

                 end
               end
-              verify :method => :put, :only => :update, :render => {:nothing => true, :status => :method_not_allowed }
               # Creates a new page or updates an existing one
               def update
                 return render_403 unless editable?
                 end
               end
-              verify :method => :post, :only => :protect, :redirect_to => { :action => :show }
               def protect
                 @page.update_attribute :protected, params[:protected]
                 redirect_to :action => 'show', :project_id => @project, :id => @page.title
                 render_404 unless @annotate
               end
-              verify :method => :delete, :only => [:destroy], :redirect_to => { :action => :show }
               # Removes a wiki page and its history
               # Children can be either set as root pages, removed or reassigned to another parent page
               def destroy

0

test/functional/issues_controller_test.rb 0 -14

@@ -2138,20 +2138,6 class IssuesControllerTest < ActionController::TestCase
2138	assert_equal 'This is the test_new issue', issue.subject	2138	assert_equal 'This is the test_new issue', issue.subject
2139	end	2139	end
2140		2140
2141	def test_update_using_invalid_http_verbs
2142	@request.session[:user_id] = 2
2143	subject = 'Updated by an invalid http verb'
2144
2145	get :update, :id => 1, :issue => {:subject => subject}
2146	assert_not_equal subject, Issue.find(1).subject
2147
2148	post :update, :id => 1, :issue => {:subject => subject}
2149	assert_not_equal subject, Issue.find(1).subject
2150
2151	delete :update, :id => 1, :issue => {:subject => subject}
2152	assert_not_equal subject, Issue.find(1).subject
2153	end
2154
2155	def test_put_update_without_custom_fields_param	2141	def test_put_update_without_custom_fields_param
2156	@request.session[:user_id] = 2	2142	@request.session[:user_id] = 2
2157	ActionMailer::Base.deliveries.clear	2143	ActionMailer::Base.deliveries.clear

0

test/functional/projects_controller_test.rb 0 -12

                 end
               end
-              def test_create_should_not_accept_get
-                @request.session[:user_id] = 1
-                get :create
-                assert_response :method_not_allowed
-              end
               def test_show_by_id
                 get :show, :id => 1
                 assert_response :success
                 assert_equal ['documents', 'issue_tracking', 'repository'], Project.find(1).enabled_module_names.sort
               end
-              def test_modules_should_not_allow_get
-                @request.session[:user_id] = 1
-                get :modules, :id => 1
-                assert_response :method_not_allowed
-              end
               def test_destroy_without_confirmation
                 @request.session[:user_id] = 1 # admin
                 delete :destroy, :id => 1

0

test/functional/users_controller_test.rb 0 -7

                 assert_nil User.find_by_id(2)
               end
-              def test_destroy_should_not_accept_get_requests
-                assert_no_difference 'User.count' do
-                  get :destroy, :id => 2
-                end
-                assert_response 405
-              end
               def test_destroy_should_be_denied_for_non_admin_users
                 @request.session[:user_id] = 3

0

test/functional/watchers_controller_test.rb 0 -6

                 User.current = nil
               end
-              def test_get_watch_should_be_invalid
-                @request.session[:user_id] = 3
-                get :watch, :object_type => 'issue', :object_id => '1'
-                assert_response 405
-              end
               def test_watch
                 @request.session[:user_id] = 3
                 assert_difference('Watcher.count') do

0

test/integration/issues_test.rb +19 0

@@ -206,4 +206,23 class IssuesTest < ActionController::IntegrationTest
206	}	206	}
207	}	207	}
208	end	208	end
		209
		210	def test_update_using_invalid_http_verbs
		211	subject = 'Updated by an invalid http verb'
		212
		213	get '/issues/update/1', {:issue => {:subject => subject}}, credentials('jsmith')
		214	assert_response 404
		215	assert_not_equal subject, Issue.find(1).subject
		216
		217	post '/issues/1', {:issue => {:subject => subject}}, credentials('jsmith')
		218	assert_response 405
		219	assert_not_equal subject, Issue.find(1).subject
		220	end
		221
		222	def test_get_watch_should_be_invalid
		223	assert_no_difference 'Watcher.count' do
		224	get '/watchers/watch?object_type=issue&object_id=1', {}, credentials('jsmith')
		225	assert_response 405
		226	end
		227	end
209	end	228	end

0

test/integration/projects_test.rb +8 -1

             require File.expand_path('../../test_helper', __FILE__)
             class ProjectsTest < ActionController::IntegrationTest
-              fixtures :projects, :users, :members
+              fixtures :projects, :users, :members, :enabled_modules
               def test_archive_project
                 subproject = Project.find(1).children.first
                 get "projects/1"
                 assert_response :success
               end
+              def test_modules_should_not_allow_get
+                assert_no_difference 'EnabledModule.count' do
+                  get '/projects/1/modules', {:enabled_module_names => ['']}, credentials('jsmith')
+                  assert_response :method_not_allowed
+                end
+              end
             end

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages