mirror of
https://github.com/go-gitea/gitea.git
synced 2025-12-29 21:01:33 +00:00
42d294941c
Removes the CSRF cookie in favor of [`CrossOriginProtection`](https://pkg.go.dev/net/http#CrossOriginProtection) which relies purely on HTTP headers. Fixes: https://github.com/go-gitea/gitea/issues/11188 Fixes: https://github.com/go-gitea/gitea/issues/30333 Helps: https://github.com/go-gitea/gitea/issues/35107 TODOs: - [x] Fix tests - [ ] Ideally add tests to validates the protection --------- Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
105 lines
2.6 KiB
Go
105 lines
2.6 KiB
Go
// Copyright 2021 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"strconv"
|
|
"testing"
|
|
|
|
"code.gitea.io/gitea/models/unittest"
|
|
user_model "code.gitea.io/gitea/models/user"
|
|
"code.gitea.io/gitea/tests"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestAdminViewUsers(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
session := loginUser(t, "user1")
|
|
req := NewRequest(t, "GET", "/-/admin/users")
|
|
session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
session = loginUser(t, "user2")
|
|
req = NewRequest(t, "GET", "/-/admin/users")
|
|
session.MakeRequest(t, req, http.StatusForbidden)
|
|
}
|
|
|
|
func TestAdminViewUser(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
session := loginUser(t, "user1")
|
|
req := NewRequest(t, "GET", "/-/admin/users/1")
|
|
session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
session = loginUser(t, "user2")
|
|
req = NewRequest(t, "GET", "/-/admin/users/1")
|
|
session.MakeRequest(t, req, http.StatusForbidden)
|
|
}
|
|
|
|
func TestAdminEditUser(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
testSuccessfullEdit(t, user_model.User{ID: 2, Name: "newusername", LoginName: "otherlogin", Email: "new@e-mail.gitea"})
|
|
}
|
|
|
|
func testSuccessfullEdit(t *testing.T, formData user_model.User) {
|
|
makeRequest(t, formData, http.StatusSeeOther)
|
|
}
|
|
|
|
func makeRequest(t *testing.T, formData user_model.User, headerCode int) {
|
|
session := loginUser(t, "user1")
|
|
req := NewRequestWithValues(t, "POST", "/-/admin/users/"+strconv.Itoa(int(formData.ID))+"/edit", map[string]string{
|
|
"user_name": formData.Name,
|
|
"login_name": formData.LoginName,
|
|
"login_type": "0-0",
|
|
"email": formData.Email,
|
|
})
|
|
|
|
session.MakeRequest(t, req, headerCode)
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: formData.ID})
|
|
assert.Equal(t, formData.Name, user.Name)
|
|
assert.Equal(t, formData.LoginName, user.LoginName)
|
|
assert.Equal(t, formData.Email, user.Email)
|
|
}
|
|
|
|
func TestAdminDeleteUser(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
session := loginUser(t, "user1")
|
|
|
|
usersToDelete := []struct {
|
|
userID int64
|
|
purge bool
|
|
}{
|
|
{
|
|
userID: 2,
|
|
purge: true,
|
|
},
|
|
{
|
|
userID: 8,
|
|
},
|
|
}
|
|
|
|
for _, entry := range usersToDelete {
|
|
t.Run(fmt.Sprintf("DeleteUser%d", entry.userID), func(t *testing.T) {
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: entry.userID})
|
|
assert.NotNil(t, user)
|
|
|
|
var query string
|
|
if entry.purge {
|
|
query = "?purge=true"
|
|
}
|
|
|
|
req := NewRequest(t, "POST", fmt.Sprintf("/-/admin/users/%d/delete%s", entry.userID, query))
|
|
session.MakeRequest(t, req, http.StatusSeeOther)
|
|
|
|
assertUserDeleted(t, entry.userID)
|
|
unittest.CheckConsistencyFor(t, &user_model.User{})
|
|
})
|
|
}
|
|
}
|