mirror of
https://github.com/go-gitea/gitea.git
synced 2026-01-06 17:16:44 +01:00
42d294941c
Removes the CSRF cookie in favor of [`CrossOriginProtection`](https://pkg.go.dev/net/http#CrossOriginProtection) which relies purely on HTTP headers. Fixes: https://github.com/go-gitea/gitea/issues/11188 Fixes: https://github.com/go-gitea/gitea/issues/30333 Helps: https://github.com/go-gitea/gitea/issues/35107 TODOs: - [x] Fix tests - [ ] Ideally add tests to validates the protection --------- Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
74 lines
1.9 KiB
Go
74 lines
1.9 KiB
Go
// Copyright 2017 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"net/http"
|
|
"net/url"
|
|
"testing"
|
|
|
|
"code.gitea.io/gitea/modules/translation"
|
|
"code.gitea.io/gitea/tests"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestViewBranches(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
req := NewRequest(t, "GET", "/user2/repo1/branches")
|
|
resp := MakeRequest(t, req, http.StatusOK)
|
|
|
|
htmlDoc := NewHTMLParser(t, resp.Body)
|
|
_, exists := htmlDoc.doc.Find(".delete-branch-button").Attr("data-url")
|
|
assert.False(t, exists, "The template has changed")
|
|
}
|
|
|
|
func TestDeleteBranch(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
deleteBranch(t)
|
|
}
|
|
|
|
func TestUndoDeleteBranch(t *testing.T) {
|
|
onGiteaRun(t, func(t *testing.T, u *url.URL) {
|
|
deleteBranch(t)
|
|
htmlDoc, name := branchAction(t, ".restore-branch-button")
|
|
assert.Contains(t,
|
|
htmlDoc.doc.Find(".ui.positive.message").Text(),
|
|
translation.NewLocale("en-US").TrString("repo.branch.restore_success", name),
|
|
)
|
|
})
|
|
}
|
|
|
|
func deleteBranch(t *testing.T) {
|
|
htmlDoc, name := branchAction(t, ".delete-branch-button")
|
|
assert.Contains(t,
|
|
htmlDoc.doc.Find(".ui.positive.message").Text(),
|
|
translation.NewLocale("en-US").TrString("repo.branch.deletion_success", name),
|
|
)
|
|
}
|
|
|
|
func branchAction(t *testing.T, button string) (*HTMLDoc, string) {
|
|
session := loginUser(t, "user2")
|
|
req := NewRequest(t, "GET", "/user2/repo1/branches")
|
|
resp := session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
htmlDoc := NewHTMLParser(t, resp.Body)
|
|
link, exists := htmlDoc.doc.Find(button).Attr("data-url")
|
|
if !assert.True(t, exists, "The template has changed") {
|
|
t.Skip()
|
|
}
|
|
|
|
req = NewRequest(t, "POST", link)
|
|
session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
url, err := url.Parse(link)
|
|
assert.NoError(t, err)
|
|
req = NewRequest(t, "GET", "/user2/repo1/branches")
|
|
resp = session.MakeRequest(t, req, http.StatusOK)
|
|
|
|
return NewHTMLParser(t, resp.Body), url.Query().Get("name")
|
|
}
|