diff options
Diffstat (limited to 'test/functional')
| -rw-r--r-- | test/functional/account_controller_test.rb | 36 |
1 files changed, 36 insertions, 0 deletions
diff --git a/test/functional/account_controller_test.rb b/test/functional/account_controller_test.rb index 991a8fb72..faf7356ea 100644 --- a/test/functional/account_controller_test.rb +++ b/test/functional/account_controller_test.rb @@ -71,6 +71,22 @@ class AccountControllerTest < ActionController::TestCase end end + def test_login_with_suburi_should_redirect_to_back_url_param + @relative_url_root = ApplicationController.relative_url_root + ApplicationController.relative_url_root = '/redmine' + + back_urls = [ + 'http://test.host/redmine/issues/show/1', + '/redmine' + ] + back_urls.each do |back_url| + post :login, :username => 'jsmith', :password => 'jsmith', :back_url => back_url + assert_redirected_to back_url + end + ensure + ApplicationController.relative_url_root = @relative_url_root + end + def test_login_should_not_redirect_to_another_host back_urls = [ 'http://test.foo/fake', @@ -82,6 +98,26 @@ class AccountControllerTest < ActionController::TestCase end end + def test_login_with_suburi_should_not_redirect_to_another_suburi + @relative_url_root = ApplicationController.relative_url_root + ApplicationController.relative_url_root = '/redmine' + + back_urls = [ + 'http://test.host/', + 'http://test.host/fake', + 'http://test.host/fake/issues', + 'http://test.host/redmine/../fake', + 'http://test.host/redmine/../fake/issues', + 'http://test.host/redmine/%2e%2e/fake' + ] + back_urls.each do |back_url| + post :login, :username => 'jsmith', :password => 'jsmith', :back_url => back_url + assert_redirected_to '/my/page' + end + ensure + ApplicationController.relative_url_root = @relative_url_root + end + def test_login_with_wrong_password post :login, :username => 'admin', :password => 'bad' assert_response :success |