Changeset 947

Timestamp:

11/15/08 17:19:39 (4 years ago)

Author:

ditzone

Message:

Fix for security check on textblock restor

Location:

trunk

Files:

• tests/textblock.php (modified) (1 diff)
• www/controllers/textblock.php (modified) (1 diff)

trunk/tests/textblock.php

@@ -261 +261 @@
 log_assert_equal($res['redirect_count'],  0);
 
+log_print("Testing security for restore");
+$res = curl_test(array(
+        'url' => url_textblock_edit('sandbox/test_page_revision'),
+        'user' => 'test_admin',
+        'post' => array(
+                'text' => "ugu 1\n",
+                'title' => "Test ugu 1",
+                'security' => "private",
+                'last_revision' => "0",
+)));
+usleep(1000000);
+$res = curl_test(array(
+        'url' => url_textblock_edit('sandbox/test_page_revision'),
+        'user' => 'test_admin',
+        'post' => array(
+                'text' => "ugu 2\n",
+                'title' => "Test ugu 2",
+                'security' => "protected",
+                'last_revision' => "1",
+)));
+usleep(1000000);
+$res = curl_test(array(
+        'url' => url_textblock_edit('sandbox/test_page_revision'),
+        'user' => 'test_admin',
+        'post' => array(
+                'text' => "ugu 3\n",
+                'title' => "Test ugu 3",
+                'security' => "public",
+                'last_revision' => "2",
+)));
+usleep(1000000);
+$res = curl_test(array(
+        'url' => url_textblock_restore('sandbox/test_page_revision', 1),
+        'user' => 'test_dude1',
+        'post' => array()
+));
+log_assert_equal($res['url'],  url_absolute(url_home()));
+log_assert(!strstr($res['content'], 'Nu ai permisiuni'));
+$res = curl_test(array(
+        'url' => url_textblock_restore('sandbox/test_page_revision', 2),
+        'user' => 'test_dude1',
+        'post' => array()
+));
+log_assert_equal($res['url'],  url_absolute(url_home()));
+log_assert(!strstr($res['content'], 'Nu ai permisiuni'));
 log_print("Textblock tests all passed");
 test_cleanup();

trunk/www/controllers/textblock.php

@@ -117 +117 @@
     $rev = textblock_get_revision($page_name, $rev_num);
 
-    if ($page) {
+    if ($page and $rev) {
         identity_require('textblock-restore', $page);
+        identity_require('textblock-restore', $rev);
     } else {
         flash_error("Pagina nu exista");