jro_apps/redmine Commit - r8941:b3866b05c14b

0

test/integration/users_test.rb created 644 +29 0

			@@ -0,0 +1,29
		1	# Redmine - project management software
		2	# Copyright (C) 2006-2012 Jean-Philippe Lang
		3	#
		4	# This program is free software; you can redistribute it and/or
		5	# modify it under the terms of the GNU General Public License
		6	# as published by the Free Software Foundation; either version 2
		7	# of the License, or (at your option) any later version.
		8	#
		9	# This program is distributed in the hope that it will be useful,
		10	# but WITHOUT ANY WARRANTY; without even the implied warranty of
		11	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		12	# GNU General Public License for more details.
		13	#
		14	# You should have received a copy of the GNU General Public License
		15	# along with this program; if not, write to the Free Software
		16	# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
		17
		18	require File.expand_path('../../test_helper', __FILE__)
		19
		20	class USersTest < ActionController::IntegrationTest
		21	fixtures :users
		22
		23	def test_destroy_should_not_accept_get_requests
		24	assert_no_difference 'User.count' do
		25	get '/users/destroy/2', {}, credentials('admin')
		26	assert_response 404
		27	end
		28	end
		29	end

0

app/controllers/attachments_controller.rb 0 -1

                  end
                end
-               verify :method => :delete, :only => :destroy
                def destroy
                  # Make sure association callbacks are called
                  @attachment.container.attachments.delete(@attachment)

0

app/controllers/auth_sources_controller.rb 0 -4

                before_filter :require_admin
-               # GETs should be safe (see http://www.w3.org/2001/tag/doc/whenToUseGet.html)
-               verify :method => :post, :only => [ :destroy, :create, :update ],
-                      :redirect_to => { :template => :index }
                def index
                  @auth_source_pages, @auth_sources = paginate auth_source_class.name.tableize, :per_page => 10
                  render "auth_sources/index"

0

app/controllers/boards_controller.rb 0 -3

                  @board = @project.boards.build(params[:board])
                end
-               verify :method => :post, :only => :create, :redirect_to => { :action => :index }
                def create
                  @board = @project.boards.build(params[:board])
                  if @board.save
                def edit
                end
-               verify :method => :put, :only => :update, :redirect_to => { :action => :index }
                def update
                  if @board.update_attributes(params[:board])
                    redirect_to_settings_in_projects
                  end
                end
-               verify :method => :delete, :only => :destroy, :redirect_to => { :action => :index }
                def destroy
                  @board.destroy
                  redirect_to_settings_in_projects

0

app/controllers/comments_controller.rb 0 -2

                before_filter :find_project_from_association
                before_filter :authorize
-               verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
                def create
                  raise Unauthorized unless @news.commentable?
                  redirect_to :controller => 'news', :action => 'show', :id => @news
                end
-               verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }
                def destroy
                  @news.comments.find(params[:comment_id]).destroy
                  redirect_to :controller => 'news', :action => 'show', :id => @news

0

app/controllers/enumerations_controller.rb 0 -1

                  end
                end
-               verify :method => :delete, :only => :destroy, :render => { :nothing => true, :status => :method_not_allowed }
                def destroy
                  if !@enumeration.in_use?
                    # No associated objects

0

app/controllers/issue_categories_controller.rb 0 -3

                  @category = @project.issue_categories.build(params[:issue_category])
                end
-               verify :method => :post, :only => :create
                def create
                  @category = @project.issue_categories.build(params[:issue_category])
                  if @category.save
                def edit
                end
-               verify :method => :put, :only => :update
                def update
                  if @category.update_attributes(params[:issue_category])
                    respond_to do |format|
                  end
                end
-               verify :method => :delete, :only => :destroy
                def destroy
                  @issue_count = @category.issues.size
                  if @issue_count == 0 || params[:todo] || api_request?

0

app/controllers/issue_relations_controller.rb 0 -2

                  end
                end
-               verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
                def create
                  @relation = IssueRelation.new(params[:relation])
                  @relation.issue_from = @issue
                  end
                end
-               verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }
                def destroy
                  raise Unauthorized unless @relation.deletable?
                  @relation.destroy

0

app/controllers/issue_statuses_controller.rb 0 -1

                  end
                end
-               verify :method => :delete, :only => :destroy, :redirect_to => { :action => :index }
                def destroy
                  IssueStatus.find(params[:id]).destroy
                  redirect_to :action => 'index'

0

app/controllers/issues_controller.rb 0 -5

                helper :gantt
                include Redmine::Export::PDF
-               verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
-               verify :method => :post, :only => :bulk_update, :render => {:nothing => true, :status => :method_not_allowed }
-               verify :method => :put, :only => :update, :render => {:nothing => true, :status => :method_not_allowed }
                def index
                  retrieve_query
                  sort_init(@query.sort_criteria.empty? ? [['id', 'desc']] : @query.sort_criteria)
                  end
                end
-               verify :method => :delete, :only => :destroy, :render => { :nothing => true, :status => :method_not_allowed }
                def destroy
                  @hours = TimeEntry.sum(:hours, :conditions => ['issue_id IN (?)', @issues]).to_f
                  if @hours > 0

0

app/controllers/mail_handler_controller.rb 0 -4

              class MailHandlerController < ActionController::Base
                before_filter :check_credential
-               verify :method => :post,
-                      :only => :index,
-                      :render => { :nothing => true, :status => 405 }
                # Submits an incoming email to MailHandler
                def index
                  options = params.dup

0

app/controllers/messages_controller.rb 0 -3

                before_filter :find_message, :except => [:new, :preview]
                before_filter :authorize, :except => [:preview, :edit, :destroy]
-               verify :method => :post, :only => [ :reply, :destroy ], :redirect_to => { :action => :show }
-               verify :xhr => true, :only => :quote
                helper :watchers
                helper :attachments
                include AttachmentsHelper

0

app/controllers/my_controller.rb 0 -3

                                    'right' => ['issuesreportedbyme']
                                 }.freeze
-               verify :xhr => true,
-                      :only => [:add_block, :remove_block, :order_blocks]
                def index
                  page
                  render :action => 'page'

0

app/controllers/projects_controller.rb 0 -5

                  @project = Project.new(params[:project])
                end
-               verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
                def create
                  @issue_custom_fields = IssueCustomField.find(:all, :order => "#{CustomField.table_name}.position")
                  @trackers = Tracker.all
                def edit
                end
-               # TODO: convert to PUT only
-               verify :method => [:post, :put], :only => :update, :render => {:nothing => true, :status => :method_not_allowed }
                def update
                  @project.safe_attributes = params[:project]
                  if validate_parent_id && @project.save
                  end
                end
-               verify :method => :post, :only => :modules, :render => {:nothing => true, :status => :method_not_allowed }
                def modules
                  @project.enabled_module_names = params[:enabled_module_names]
                  flash[:notice] = l(:notice_successful_update)
                  redirect_to(url_for(:controller => 'admin', :action => 'projects', :status => params[:status]))
                end
-               verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }
                # Delete @project
                def destroy
                  @project_to_destroy = @project

0

app/controllers/queries_controller.rb 0 -3

                  build_query_from_params
                end
-               verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
                def create
                  @query = Query.new(params[:query])
                  @query.user = User.current
                def edit
                end
-               verify :method => :put, :only => :update, :render => {:nothing => true, :status => :method_not_allowed }
                def update
                  @query.attributes = params[:query]
                  @query.project = nil if params[:query_is_for_all]
                  end
                end
-               verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }
                def destroy
                  @query.destroy
                  redirect_to :controller => 'issues', :action => 'index', :project_id => @project, :set_filter => 1

0

app/controllers/roles_controller.rb 0 -1

                  end
                end
-               verify :method => :delete, :only => :destroy, :redirect_to => { :action => :index }
                def destroy
                  @role.destroy
                  redirect_to :action => 'index'

0

app/controllers/timelog_controller.rb 0 -3

                  @time_entry.attributes = params[:time_entry]
                end
-               verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
                def create
                  @time_entry ||= TimeEntry.new(:project => @project, :issue => @issue, :user => User.current, :spent_on => User.current.today)
                  @time_entry.attributes = params[:time_entry]
                  @time_entry.attributes = params[:time_entry]
                end
-               verify :method => :put, :only => :update, :render => {:nothing => true, :status => :method_not_allowed }
                def update
                  @time_entry.attributes = params[:time_entry]
                  redirect_back_or_default({:controller => 'timelog', :action => 'index', :project_id => @projects.first})
                end
-               verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }
                def destroy
                  @time_entries.each do |t|
                    begin

0

app/controllers/trackers_controller.rb 0 -1

                  render :action => 'edit'
                end
-               verify :method => :delete, :only => :destroy, :redirect_to => { :action => :index }
                def destroy
                  @tracker = Tracker.find(params[:id])
                  unless @tracker.issues.empty?

0

app/controllers/users_controller.rb 0 -5

                  @auth_sources = AuthSource.find(:all)
                end
-               verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
                def create
                  @user = User.new(:language => Setting.default_language, :mail_notification => Setting.default_notification_option)
                  @user.safe_attributes = params[:user]
                  @membership ||= Member.new
                end
-               verify :method => :put, :only => :update, :render => {:nothing => true, :status => :method_not_allowed }
                def update
                  @user.admin = params[:user][:admin] if params[:user][:admin]
                  @user.login = params[:user][:login] if params[:user][:login]
                  redirect_to :controller => 'users', :action => 'edit', :id => @user
                end
-               verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }
                def destroy
                  @user.destroy
                  respond_to do |format|
                  end
                end
-               verify :method => [:post, :put], :only => :edit_membership, :render => {:nothing => true, :status => :method_not_allowed }
                def edit_membership
                  @membership = Member.edit_membership(params[:membership_id], params[:membership], @user)
                  @membership.save
                  end
                end
-               verify :method => :delete, :only => :destroy_membership, :render => {:nothing => true, :status => :method_not_allowed }
                def destroy_membership
                  @membership = Member.find(params[:membership_id])
                  if @membership.deletable?

0

app/controllers/versions_controller.rb 0 -1

                  redirect_to :controller => 'projects', :action => 'settings', :tab => 'versions', :id => @project
                end
-               verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }
                def destroy
                  if @version.fixed_issues.empty?
                    @version.destroy

0

app/controllers/watchers_controller.rb 0 -4

                before_filter :require_login, :check_project_privacy, :only => [:watch, :unwatch]
                before_filter :authorize, :only => [:new, :destroy]
-               verify :method => :post,
-                      :only => [ :watch, :unwatch ],
-                      :render => { :nothing => true, :status => :method_not_allowed }
                def watch
                  if @watched.respond_to?(:visible?) && !@watched.visible?(User.current)
                    render_403

0

app/controllers/wiki_controller.rb 0 -3

                  end
                end
-               verify :method => :put, :only => :update, :render => {:nothing => true, :status => :method_not_allowed }
                # Creates a new page or updates an existing one
                def update
                  return render_403 unless editable?
                  end
                end
-               verify :method => :post, :only => :protect, :redirect_to => { :action => :show }
                def protect
                  @page.update_attribute :protected, params[:protected]
                  redirect_to :action => 'show', :project_id => @project, :id => @page.title
                  render_404 unless @annotate
                end
-               verify :method => :delete, :only => [:destroy], :redirect_to => { :action => :show }
                # Removes a wiki page and its history
                # Children can be either set as root pages, removed or reassigned to another parent page
                def destroy

0

test/functional/issues_controller_test.rb 0 -14

                  assert_equal 'This is the test_new issue', issue.subject
                end
-               def test_update_using_invalid_http_verbs
-                 @request.session[:user_id] = 2
-                 subject = 'Updated by an invalid http verb'
-                 get :update, :id => 1, :issue => {:subject => subject}
-                 assert_not_equal subject, Issue.find(1).subject
-                 post :update, :id => 1, :issue => {:subject => subject}
-                 assert_not_equal subject, Issue.find(1).subject
-                 delete :update, :id => 1, :issue => {:subject => subject}
-                 assert_not_equal subject, Issue.find(1).subject
-               end
                def test_put_update_without_custom_fields_param
                  @request.session[:user_id] = 2
                  ActionMailer::Base.deliveries.clear

0

test/functional/projects_controller_test.rb 0 -12

                  end
                end
-               def test_create_should_not_accept_get
-                 @request.session[:user_id] = 1
-                 get :create
-                 assert_response :method_not_allowed
-               end
                def test_show_by_id
                  get :show, :id => 1
                  assert_response :success
                  assert_equal ['documents', 'issue_tracking', 'repository'], Project.find(1).enabled_module_names.sort
                end
-               def test_modules_should_not_allow_get
-                 @request.session[:user_id] = 1
-                 get :modules, :id => 1
-                 assert_response :method_not_allowed
-               end
                def test_destroy_without_confirmation
                  @request.session[:user_id] = 1 # admin
                  delete :destroy, :id => 1

0

test/functional/users_controller_test.rb 0 -7

                  assert_nil User.find_by_id(2)
                end
-               def test_destroy_should_not_accept_get_requests
-                 assert_no_difference 'User.count' do
-                   get :destroy, :id => 2
-                 end
-                 assert_response 405
-               end
                def test_destroy_should_be_denied_for_non_admin_users
                  @request.session[:user_id] = 3

0

test/functional/watchers_controller_test.rb 0 -6

                  User.current = nil
                end
-               def test_get_watch_should_be_invalid
-                 @request.session[:user_id] = 3
-                 get :watch, :object_type => 'issue', :object_id => '1'
-                 assert_response 405
-               end
                def test_watch
                  @request.session[:user_id] = 3
                  assert_difference('Watcher.count') do

0

test/integration/issues_test.rb +19 0

		@@ -206,4 +206,23 class IssuesTest < ActionController::IntegrationTest
206	206	}
207	207	}
208	208	end
	209
	210	def test_update_using_invalid_http_verbs
	211	subject = 'Updated by an invalid http verb'
	212
	213	get '/issues/update/1', {:issue => {:subject => subject}}, credentials('jsmith')
	214	assert_response 404
	215	assert_not_equal subject, Issue.find(1).subject
	216
	217	post '/issues/1', {:issue => {:subject => subject}}, credentials('jsmith')
	218	assert_response 405
	219	assert_not_equal subject, Issue.find(1).subject
	220	end
	221
	222	def test_get_watch_should_be_invalid
	223	assert_no_difference 'Watcher.count' do
	224	get '/watchers/watch?object_type=issue&object_id=1', {}, credentials('jsmith')
	225	assert_response 405
	226	end
	227	end
209	228	end

0

test/integration/projects_test.rb +8 -1

              require File.expand_path('../../test_helper', __FILE__)
              class ProjectsTest < ActionController::IntegrationTest
-               fixtures :projects, :users, :members
+               fixtures :projects, :users, :members, :enabled_modules
                def test_archive_project
                  subproject = Project.find(1).children.first
                  get "projects/1"
                  assert_response :success
                end
+               def test_modules_should_not_allow_get
+                 assert_no_difference 'EnabledModule.count' do
+                   get '/projects/1/modules', {:enabled_module_names => ['']}, credentials('jsmith')
+                   assert_response :method_not_allowed
+                 end
+               end
              end

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages