mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2026-07-25 02:48:05 +00:00
4b83448b7d
- fix: prevent stored XSS in user display name on Actions page - fix: LFS locks must belong to the intended repo, port from Gitea - fix: prevent unauthorized access to draft releases via API - fix: prevent writes to OpenID visibility which may affect other users - fix: prevent viewing private PRs that are linked to public issues on public projects Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13001 Reviewed-by: 0ko <0ko@noreply.codeberg.org> Reviewed-by: Beowulf <beowulf@beocode.eu>
71 lines
2 KiB
Go
71 lines
2 KiB
Go
// Copyright 2017 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package user_test
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"forgejo.org/models/db"
|
|
"forgejo.org/models/unittest"
|
|
user_model "forgejo.org/models/user"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestGetUserOpenIDs(t *testing.T) {
|
|
require.NoError(t, unittest.PrepareTestDatabase())
|
|
|
|
oids, err := user_model.GetUserOpenIDs(db.DefaultContext, int64(1))
|
|
require.NoError(t, err)
|
|
|
|
if assert.Len(t, oids, 2) {
|
|
assert.Equal(t, "https://user1.domain1.tld/", oids[0].URI)
|
|
assert.False(t, oids[0].Show)
|
|
assert.Equal(t, "http://user1.domain2.tld/", oids[1].URI)
|
|
assert.True(t, oids[1].Show)
|
|
}
|
|
|
|
oids, err = user_model.GetUserOpenIDs(db.DefaultContext, int64(2))
|
|
require.NoError(t, err)
|
|
|
|
if assert.Len(t, oids, 1) {
|
|
assert.Equal(t, "https://domain1.tld/user2/", oids[0].URI)
|
|
assert.True(t, oids[0].Show)
|
|
}
|
|
}
|
|
|
|
func TestToggleUserOpenIDVisibility(t *testing.T) {
|
|
require.NoError(t, unittest.PrepareTestDatabase())
|
|
oids, err := user_model.GetUserOpenIDs(db.DefaultContext, int64(2))
|
|
require.NoError(t, err)
|
|
require.Len(t, oids, 1)
|
|
|
|
assert.True(t, oids[0].Show)
|
|
|
|
err = user_model.ToggleUserOpenIDVisibility(db.DefaultContext, oids[0].UID, oids[0].ID)
|
|
require.NoError(t, err)
|
|
|
|
oids, err = user_model.GetUserOpenIDs(db.DefaultContext, int64(2))
|
|
require.NoError(t, err)
|
|
require.Len(t, oids, 1)
|
|
|
|
assert.False(t, oids[0].Show)
|
|
err = user_model.ToggleUserOpenIDVisibility(db.DefaultContext, oids[0].UID, oids[0].ID)
|
|
require.NoError(t, err)
|
|
|
|
oids, err = user_model.GetUserOpenIDs(db.DefaultContext, int64(2))
|
|
require.NoError(t, err)
|
|
require.Len(t, oids, 1)
|
|
|
|
assert.True(t, oids[0].Show)
|
|
|
|
// mismatched UID ineffective
|
|
err = user_model.ToggleUserOpenIDVisibility(db.DefaultContext, 999, oids[0].ID)
|
|
require.NoError(t, err)
|
|
oids, err = user_model.GetUserOpenIDs(db.DefaultContext, int64(2))
|
|
require.NoError(t, err)
|
|
require.Len(t, oids, 1)
|
|
assert.True(t, oids[0].Show)
|
|
}
|