X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/baf10cd39289cd7e94a819305e46f43e85a136c6..333113b8e11004903577507084ecfba85b8f7f53:/test/controllers/node_controller_test.rb diff --git a/test/controllers/node_controller_test.rb b/test/controllers/node_controller_test.rb index 9e030ed39..ffc86b2f6 100644 --- a/test/controllers/node_controller_test.rb +++ b/test/controllers/node_controller_test.rb @@ -1,4 +1,4 @@ -require 'test_helper' +require "test_helper" class NodeControllerTest < ActionController::TestCase api_fixtures @@ -39,7 +39,7 @@ class NodeControllerTest < ActionController::TestCase changeset = changesets(:normal_user_first_change) # create a minimal xml file content("") - assert_difference('OldNode.count', 0) do + assert_difference("OldNode.count", 0) do put :create end # hope for unauthorized @@ -55,7 +55,7 @@ class NodeControllerTest < ActionController::TestCase changeset = changesets(:normal_user_first_change) # create a minimal xml file content("") - assert_difference('Node.count', 0) do + assert_difference("Node.count", 0) do put :create end # hope for success @@ -298,19 +298,19 @@ class NodeControllerTest < ActionController::TestCase assert_require_public_data("update with changeset=0 should be forbidden, when data isn't public") ## try and submit invalid updates - content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lat', 91.0) + content xml_attr_rewrite(current_nodes(:visible_node).to_xml, "lat", 91.0) put :update, :id => current_nodes(:visible_node).id assert_require_public_data "node at lat=91 should be forbidden, when data isn't public" - content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lat', -91.0) + content xml_attr_rewrite(current_nodes(:visible_node).to_xml, "lat", -91.0) put :update, :id => current_nodes(:visible_node).id assert_require_public_data "node at lat=-91 should be forbidden, when data isn't public" - content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lon', 181.0) + content xml_attr_rewrite(current_nodes(:visible_node).to_xml, "lon", 181.0) put :update, :id => current_nodes(:visible_node).id assert_require_public_data "node at lon=181 should be forbidden, when data isn't public" - content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lon', -181.0) + content xml_attr_rewrite(current_nodes(:visible_node).to_xml, "lon", -181.0) put :update, :id => current_nodes(:visible_node).id assert_require_public_data "node at lon=-181 should be forbidden, when data isn't public" @@ -350,19 +350,19 @@ class NodeControllerTest < ActionController::TestCase assert_response :conflict, "update with changeset=0 should be rejected" ## try and submit invalid updates - content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lat', 91.0) + content xml_attr_rewrite(current_nodes(:visible_node).to_xml, "lat", 91.0) put :update, :id => current_nodes(:visible_node).id assert_response :bad_request, "node at lat=91 should be rejected" - content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lat', -91.0) + content xml_attr_rewrite(current_nodes(:visible_node).to_xml, "lat", -91.0) put :update, :id => current_nodes(:visible_node).id assert_response :bad_request, "node at lat=-91 should be rejected" - content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lon', 181.0) + content xml_attr_rewrite(current_nodes(:visible_node).to_xml, "lon", 181.0) put :update, :id => current_nodes(:visible_node).id assert_response :bad_request, "node at lon=181 should be rejected" - content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lon', -181.0) + content xml_attr_rewrite(current_nodes(:visible_node).to_xml, "lon", -181.0) put :update, :id => current_nodes(:visible_node).id assert_response :bad_request, "node at lon=-181 should be rejected" @@ -371,19 +371,19 @@ class NodeControllerTest < ActionController::TestCase # try and submit a version behind content xml_attr_rewrite(current_nodes(:visible_node).to_xml, - 'version', current_node_version - 1) + "version", current_node_version - 1) put :update, :id => current_nodes(:visible_node).id assert_response :conflict, "should have failed on old version number" # try and submit a version ahead content xml_attr_rewrite(current_nodes(:visible_node).to_xml, - 'version', current_node_version + 1) + "version", current_node_version + 1) put :update, :id => current_nodes(:visible_node).id assert_response :conflict, "should have failed on skipped version number" # try and submit total crap in the version field content xml_attr_rewrite(current_nodes(:visible_node).to_xml, - 'version', 'p1r4t3s!') + "version", "p1r4t3s!") put :update, :id => current_nodes(:visible_node).id assert_response :conflict, "should not be able to put 'p1r4at3s!' in the version field" @@ -437,13 +437,14 @@ class NodeControllerTest < ActionController::TestCase ## # test adding tags to a node def test_duplicate_tags + existing = create(:node_tag, :node => current_nodes(:public_visible_node)) # setup auth basic_authorization(users(:public_user).email, "test") # add an identical tag to the node tag_xml = XML::Node.new("tag") - tag_xml['k'] = current_node_tags(:public_v_t1).k - tag_xml['v'] = current_node_tags(:public_v_t1).v + tag_xml["k"] = existing.k + tag_xml["v"] = existing.v # add the tag into the existing xml node_xml = current_nodes(:public_visible_node).to_xml @@ -454,7 +455,7 @@ class NodeControllerTest < ActionController::TestCase put :update, :id => current_nodes(:public_visible_node).id assert_response :bad_request, "adding duplicate tags to a node should fail with 'bad request'" - assert_equal "Element node/#{current_nodes(:public_visible_node).id} has duplicate tags with key #{current_node_tags(:t1).k}", @response.body + assert_equal "Element node/#{current_nodes(:public_visible_node).id} has duplicate tags with key #{existing.k}", @response.body end # test whether string injection is possible @@ -466,8 +467,8 @@ class NodeControllerTest < ActionController::TestCase # try and put something into a string that the API might # use unquoted and therefore allow code injection... content "" + - '' + - '' + '' + + "" put :create assert_require_public_data "Shouldn't be able to create with non-public user" @@ -478,8 +479,8 @@ class NodeControllerTest < ActionController::TestCase # try and put something into a string that the API might # use unquoted and therefore allow code injection... content "" + - '' + - '' + '' + + "" put :create assert_response :success nodeid = @response.body @@ -496,21 +497,13 @@ class NodeControllerTest < ActionController::TestCase # check the tags are not corrupted assert_equal checknode.tags, apinode.tags - assert apinode.tags.include?('#{@user.inspect}') - end - - def basic_authorization(user, pass) - @request.env["HTTP_AUTHORIZATION"] = "Basic %s" % Base64.encode64("#{user}:#{pass}") - end - - def content(c) - @request.env["RAW_POST_DATA"] = c.to_s + assert apinode.tags.include?("\#{@user.inspect}") end ## # update the changeset_id of a node element def update_changeset(xml, changeset_id) - xml_attr_rewrite(xml, 'changeset', changeset_id) + xml_attr_rewrite(xml, "changeset", changeset_id) end ##