diff options
author | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2008-07-10 12:31:49 +0000 |
---|---|---|
committer | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2008-07-10 12:31:49 +0000 |
commit | be4cc2f99e34316be4b8beb2e9040c5ea967a736 (patch) | |
tree | 604c1ea827a9b4547fda36501b9044cd71e6a0e4 /test | |
parent | de3d5a88e4c70a06501cc51d7c2a1fcace4092a7 (diff) | |
download | redmine-be4cc2f99e34316be4b8beb2e9040c5ea967a736.tar.gz redmine-be4cc2f99e34316be4b8beb2e9040c5ea967a736.zip |
Fixed: search engine may reveal private projects (#1613).
git-svn-id: http://redmine.rubyforge.org/svn/trunk@1649 e93f8b46-1217-0410-a6f0-8f06a7374b81
Diffstat (limited to 'test')
-rw-r--r-- | test/unit/search_test.rb | 134 |
1 files changed, 134 insertions, 0 deletions
diff --git a/test/unit/search_test.rb b/test/unit/search_test.rb new file mode 100644 index 000000000..e2cc8e766 --- /dev/null +++ b/test/unit/search_test.rb @@ -0,0 +1,134 @@ +# redMine - project management software +# Copyright (C) 2006-2008 Jean-Philippe Lang +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + +require File.dirname(__FILE__) + '/../test_helper' + +class SearchTest < Test::Unit::TestCase + fixtures :users, + :members, + :projects, + :roles, + :enabled_modules, + :issues, + :trackers, + :journals, + :journal_details, + :repositories, + :changesets + + def setup + @project = Project.find(1) + @issue_keyword = '%Unable to print recipes%' + @issue = Issue.find(1) + @changeset_keyword = '%very first commit%' + @changeset = Changeset.find(100) + end + + def test_search_by_anonymous + User.current = nil + + r = Issue.search(@issue_keyword) + assert r.include?(@issue) + r = Changeset.search(@changeset_keyword) + assert r.include?(@changeset) + + # Removes the :view_changesets permission from Anonymous role + remove_permission Role.anonymous, :view_changesets + + r = Issue.search(@issue_keyword) + assert r.include?(@issue) + r = Changeset.search(@changeset_keyword) + assert !r.include?(@changeset) + + # Make the project private + @project.update_attribute :is_public, false + r = Issue.search(@issue_keyword) + assert !r.include?(@issue) + r = Changeset.search(@changeset_keyword) + assert !r.include?(@changeset) + end + + def test_search_by_user + User.current = User.find_by_login('rhill') + assert User.current.memberships.empty? + + r = Issue.search(@issue_keyword) + assert r.include?(@issue) + r = Changeset.search(@changeset_keyword) + assert r.include?(@changeset) + + # Removes the :view_changesets permission from Non member role + remove_permission Role.non_member, :view_changesets + + r = Issue.search(@issue_keyword) + assert r.include?(@issue) + r = Changeset.search(@changeset_keyword) + assert !r.include?(@changeset) + + # Make the project private + @project.update_attribute :is_public, false + r = Issue.search(@issue_keyword) + assert !r.include?(@issue) + r = Changeset.search(@changeset_keyword) + assert !r.include?(@changeset) + end + + def test_search_by_allowed_member + User.current = User.find_by_login('jsmith') + assert User.current.projects.include?(@project) + + r = Issue.search(@issue_keyword) + assert r.include?(@issue) + r = Changeset.search(@changeset_keyword) + assert r.include?(@changeset) + + # Make the project private + @project.update_attribute :is_public, false + r = Issue.search(@issue_keyword) + assert r.include?(@issue) + r = Changeset.search(@changeset_keyword) + assert r.include?(@changeset) + end + + def test_search_by_unallowed_member + # Removes the :view_changesets permission from user's and non member role + remove_permission Role.find(1), :view_changesets + remove_permission Role.non_member, :view_changesets + + User.current = User.find_by_login('jsmith') + assert User.current.projects.include?(@project) + + r = Issue.search(@issue_keyword) + assert r.include?(@issue) + r = Changeset.search(@changeset_keyword) + assert !r.include?(@changeset) + + # Make the project private + @project.update_attribute :is_public, false + r = Issue.search(@issue_keyword) + assert r.include?(@issue) + r = Changeset.search(@changeset_keyword) + assert !r.include?(@changeset) + end + + private + + def remove_permission(role, permission) + role.permissions = role.permissions - [ permission ] + role.save + end +end |