github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-23 13:31:18 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FIX: [security bug] XHR check bypass

Browse Source
This commit is contained in:
Régis Hanol
2013-04-30 02:34:19 +02:00
parent f517fa6099
commit 017ee7c2da
2 changed files with 14 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
spec/controllers/application_controller_spec.rb
View File

@ -1,7 +1,7 @@
require 'spec_helper'
describe 'api' do
before do
describe 'api' do
before do
fake_key = SecureRandom.hex(32)
SiteSetting.stubs(:api_key).returns(fake_key)
end
@ -11,26 +11,28 @@ describe 'api' do
Fabricate(:user)
end
let(:post) do
let(:post) do
Fabricate(:post)
end
# choosing an arbitrarily easy to mock trusted activity
it 'allows users with api key to bookmark posts' do
PostAction.expects(:act).with(user,post,PostActionType.types[:bookmark]).returns(true)
put :bookmark, bookmarked: "true" ,post_id: post.id , api_key: SiteSetting.api_key, api_username: user.username
PostAction.expects(:act).with(user, post, PostActionType.types[:bookmark]).once
put :bookmark, bookmarked: "true", post_id: post.id, api_key: SiteSetting.api_key, api_username: user.username, format: :json
end
it 'disallows phonies to bookmark posts' do
lambda do
put :bookmark, bookmarked: "true" ,post_id: post.id , api_key: SecureRandom.hex(32), api_username: user.username
PostAction.expects(:act).with(user, post, PostActionType.types[:bookmark]).never
lambda do
put :bookmark, bookmarked: "true", post_id: post.id, api_key: SecureRandom.hex(32), api_username: user.username, format: :json
end.should raise_error Discourse::NotLoggedIn
end
it 'disallows blank api' do
SiteSetting.stubs(:api_key).returns("")
lambda do
put :bookmark, bookmarked: "true" ,post_id: post.id , api_key: "", api_username: user.username
PostAction.expects(:act).with(user, post, PostActionType.types[:bookmark]).never
lambda do
put :bookmark, bookmarked: "true", post_id: post.id, api_key: "", api_username: user.username, format: :json
end.should raise_error Discourse::NotLoggedIn
end
end