mirror of
https://github.com/go-gitea/gitea.git
synced 2026-01-01 16:14:51 +01:00
42d294941c
Removes the CSRF cookie in favor of [`CrossOriginProtection`](https://pkg.go.dev/net/http#CrossOriginProtection) which relies purely on HTTP headers. Fixes: https://github.com/go-gitea/gitea/issues/11188 Fixes: https://github.com/go-gitea/gitea/issues/30333 Helps: https://github.com/go-gitea/gitea/issues/35107 TODOs: - [x] Fix tests - [ ] Ideally add tests to validates the protection --------- Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
54 lines
1.9 KiB
Go
54 lines
1.9 KiB
Go
// Copyright 2017 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
issues_model "code.gitea.io/gitea/models/issues"
|
|
"code.gitea.io/gitea/models/organization"
|
|
access_model "code.gitea.io/gitea/models/perm/access"
|
|
repo_model "code.gitea.io/gitea/models/repo"
|
|
"code.gitea.io/gitea/models/unittest"
|
|
user_model "code.gitea.io/gitea/models/user"
|
|
"code.gitea.io/gitea/tests"
|
|
)
|
|
|
|
func assertUserDeleted(t *testing.T, userID int64) {
|
|
unittest.AssertNotExistsBean(t, &user_model.User{ID: userID})
|
|
unittest.AssertNotExistsBean(t, &user_model.Follow{UserID: userID})
|
|
unittest.AssertNotExistsBean(t, &user_model.Follow{FollowID: userID})
|
|
unittest.AssertNotExistsBean(t, &repo_model.Repository{OwnerID: userID})
|
|
unittest.AssertNotExistsBean(t, &access_model.Access{UserID: userID})
|
|
unittest.AssertNotExistsBean(t, &organization.OrgUser{UID: userID})
|
|
unittest.AssertNotExistsBean(t, &issues_model.IssueUser{UID: userID})
|
|
unittest.AssertNotExistsBean(t, &organization.TeamUser{UID: userID})
|
|
unittest.AssertNotExistsBean(t, &repo_model.Star{UID: userID})
|
|
}
|
|
|
|
func TestUserDeleteAccount(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
session := loginUser(t, "user8")
|
|
urlStr := "/user/settings/account/delete?password=" + userPassword
|
|
req := NewRequest(t, "POST", urlStr)
|
|
session.MakeRequest(t, req, http.StatusSeeOther)
|
|
|
|
assertUserDeleted(t, 8)
|
|
unittest.CheckConsistencyFor(t, &user_model.User{})
|
|
}
|
|
|
|
func TestUserDeleteAccountStillOwnRepos(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
session := loginUser(t, "user2")
|
|
urlStr := "/user/settings/account/delete?password=" + userPassword
|
|
req := NewRequest(t, "POST", urlStr)
|
|
session.MakeRequest(t, req, http.StatusSeeOther)
|
|
|
|
// user should not have been deleted, because the user still owns repos
|
|
unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
|
|
}
|