test: upload in wrong folder
Massimo Melina committed
Sep 26, 2023 at 10:14 UTC
9e041ac5e43ce6b37989e8858eb7240af852abfa
1 file changed
+7
-5
tests/test.ts
+7
-5
@@ -18,6 +18,7 @@ const username = 'rejetto'
18
const password = 'password'
19
const API = '/~/api/'
20
const BASE_URL = 'http://localhost'
21
+const UPLOAD_URI = '/for-admins/upload/temp/gpl.png'
22
23
const jar = new CookieJar()
24
const client = wrapper(axios.create({ jar, maxRedirects: 0 }))
@@ -97,7 +98,7 @@ describe('basics', () => {
98
headers: { Referer: 'https://some-website.com/try-to-trick/x.com/' }
99
}))
100
100
- testUpload('upload.missing perm', 401)
101
+ testUpload('upload.need account', UPLOAD_URI, 401)
102
it('of_disabled.cantLogin', () => login('of_disabled').then(() => { throw Error('logged in') }, () => 0))
103
})
104
@@ -112,8 +113,9 @@ describe('after-login', () => {
113
before(() => login(username))
114
it('inherit.perm', reqList('/for-admins/', { inList:['alfa.txt'] }))
115
it('inherit.disabled', reqList('/for-disabled/', 401))
115
- testUpload('upload', 200)
116
- testUpload('upload.bad path', 418, '../../')
116
+ testUpload('upload.never', '/random', 403)
117
+ testUpload('upload.ok', UPLOAD_URI, 200)
118
+ testUpload('upload.crossing', UPLOAD_URI.replace('temp', '../..'), 418)
119
after(() =>
120
rmSync(join(__dirname, 'temp'), { recursive: true}))
121
})
@@ -123,8 +125,8 @@ function login(usr: string, pwd=password) {
125
reqApi(cmd, params, (x,res)=> !res.isAxiosError)())
126
}
127
126
-function testUpload(name: string, tester: Tester, path = 'temp/') {
127
- it(name, req('PUT/for-admins/upload/'+join(path+'gpl.png'), tester, {
128
+function testUpload(name: string, dest: string, tester: Tester) {
129
+ it(name, req('PUT' + dest, tester, {
130
data: createReadStream(join(__dirname, 'page/gpl.png'))
131
}))
132
}