tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Load a saved story into the form for editors only.

Browse Source 
Visitors could post an id to /publish and read the author's email address.
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent 8f4851e576
commit bf36ec25fd
2 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/php/Pages/SubmitTest.php
+11
View File
@@ -97,6 +97,17 @@ class SubmitTest extends PageTestCase {
$this->assertSame(array('original author', 0, ''), array($tables['queue'][0]['editor'], $tables['queue'][0]['hidden'], $tables['queue'][0]['comments']));
}
public function testVisitorsCannotLoadAStoryIntoTheForm(): void {
$this->setTables(array('xxx' => array(array('id' => 7, 'title' => 'Live one', 'email' => 'author@example.org'))));
$token = $this->csrfToken($this->get('/publish')['body']);
foreach (array('edit', 'choose', 'other') as $action) {
$page = $this->post('/publish', array('action' => $action, 'id' => '7', 'csrf_token' => $token));
$this->assertStringNotContainsString('author@example.org', $page['body']);
$this->assertStringNotContainsString('Live one', $page['body']);
}
$this->assertSame(array(), $this->queries('/^SELECT \* FROM xxx/'));
}
public function testAPostWithoutTheTokenOnlyGetsAPreview(): void {
$this->get('/publish');
$page = $this->post('/publish', $this->story(array('action' => 'submit', 'csrf_token' => 'wrong', 'g-recaptcha-response' => 'pass')));