Mercurial > p > roundup > code
diff test/test_cgi.py @ 4088:34434785f308
Plug a number of security holes:
- EditCSV and ExportCSV altered to include permission checks
- HTTP POST required on actions which alter data
- HTML file uploads served as application/octet-stream
- New item action reject creation of new users
- Item retirement was not being controlled
Additionally include documentation of the changes and modify affected tests.
| author | Richard Jones <richard@users.sourceforge.net> |
|---|---|
| date | Thu, 12 Mar 2009 02:25:03 +0000 |
| parents | efcea2fe69be |
| children | 6441ffe588f7 |
line wrap: on
line diff
--- a/test/test_cgi.py Tue Mar 10 21:01:20 2009 +0000 +++ b/test/test_cgi.py Thu Mar 12 02:25:03 2009 +0000 @@ -85,8 +85,8 @@ re.VERBOSE) def parseForm(self, form, classname='test', nodeid=None): - cl = client.Client(self.instance, None, {'PATH_INFO':'/'}, - makeForm(form)) + cl = client.Client(self.instance, None, {'PATH_INFO':'/', + 'REQUEST_METHOD':'POST'}, makeForm(form)) cl.classname = classname cl.nodeid = nodeid cl.language = ('en',) @@ -615,8 +615,8 @@ # # XXX test all default permissions def _make_client(self, form, classname='user', nodeid='2', userid='2'): - cl = client.Client(self.instance, None, {'PATH_INFO':'/'}, - makeForm(form)) + cl = client.Client(self.instance, None, {'PATH_INFO':'/', + 'REQUEST_METHOD':'POST'}, makeForm(form)) cl.classname = 'user' cl.nodeid = '1' cl.db = self.db