gapodo/forgejo
gapodo/forgejo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Disallow unauthenticated call to users/{user}/orgs

Browse source
This commit is contained in:
harryzcy 2022-11-01 03:46:37 -04:00
parent 45f716f5c8
commit 8b0bc32902
No known key found for this signature in database
GPG key ID: CC2953E050C19686
1 changed files with 10 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
tests/integration/api_user_orgs_test.go
View file

@ -62,18 +62,13 @@ func TestUserOrgs(t *testing.T) {
orgs = getUserOrgs(t, unrelatedUsername, privateMemberUsername) orgs = getUserOrgs(t, unrelatedUsername, privateMemberUsername)
assert.Len(t, orgs, 0) assert.Len(t, orgs, 0)
// not authenticated call also should hide org membership // not authenticated call should not be allowed
orgs = getUserOrgs(t, "", privateMemberUsername) testUserOrgsUnauthenticated(t, privateMemberUsername)
assert.Len(t, orgs, 0)
} }
func getUserOrgs(t *testing.T, userDoer, userCheck string) (orgs []*api.Organization) { func getUserOrgs(t *testing.T, userDoer, userCheck string) (orgs []*api.Organization) {
token := "" session := loginUser(t, userDoer)
session := emptyTestSession(t) token := getTokenForLoggedInUser(t, session, "read_org")
if len(userDoer) != 0 {
session = loginUser(t, userDoer)
token = getTokenForLoggedInUser(t, session, "read_org")
}
urlStr := fmt.Sprintf("/api/v1/users/%s/orgs?token=%s", userCheck, token) urlStr := fmt.Sprintf("/api/v1/users/%s/orgs?token=%s", userCheck, token)
req := NewRequest(t, "GET", urlStr) req := NewRequest(t, "GET", urlStr)
resp := session.MakeRequest(t, req, http.StatusOK) resp := session.MakeRequest(t, req, http.StatusOK)
@ -81,6 +76,12 @@ func getUserOrgs(t *testing.T, userDoer, userCheck string) (orgs []*api.Organiza
return orgs return orgs
} }
func testUserOrgsUnauthenticated(t *testing.T, userCheck string) {
session := emptyTestSession(t)
req := NewRequestf(t, "GET", "/api/v1/users/%s/orgs", userCheck)
session.MakeRequest(t, req, http.StatusUnauthorized)
}
func TestMyOrgs(t *testing.T) { func TestMyOrgs(t *testing.T) {
defer tests.PrepareTestEnv(t)() defer tests.PrepareTestEnv(t)()