mirror of
https://github.com/go-gitea/gitea.git
synced 2024-12-01 05:41:58 +01:00
eedb8f4129
Thanks to inferenceus : some sort orders on the "explore/users" page could list users by their lastlogintime/updatetime. It leaks user's activity unintentionally. This PR makes that page only use "supported" sort orders. Removing the "sort orders" could also be a good solution, while IMO at the moment keeping the "create time" and "name" orders is also fine, in case some users would like to find a target user in the search result, the "sort order" might help. 
45 lines
1.3 KiB
Go
45 lines
1.3 KiB
Go
// Copyright 2024 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
"code.gitea.io/gitea/tests"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestExploreUser(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
cases := []struct{ sortOrder, expected string }{
|
|
{"", "/explore/users?sort=newest&q="},
|
|
{"newest", "/explore/users?sort=newest&q="},
|
|
{"oldest", "/explore/users?sort=oldest&q="},
|
|
{"alphabetically", "/explore/users?sort=alphabetically&q="},
|
|
{"reversealphabetically", "/explore/users?sort=reversealphabetically&q="},
|
|
}
|
|
for _, c := range cases {
|
|
req := NewRequest(t, "GET", "/explore/users?sort="+c.sortOrder)
|
|
resp := MakeRequest(t, req, http.StatusOK)
|
|
h := NewHTMLParser(t, resp.Body)
|
|
href, _ := h.Find(`.ui.dropdown .menu a.active.item[href^="/explore/users"]`).Attr("href")
|
|
assert.Equal(t, c.expected, href)
|
|
}
|
|
|
|
// these sort orders shouldn't be supported, to avoid leaking user activity
|
|
cases404 := []string{
|
|
"/explore/users?sort=lastlogin",
|
|
"/explore/users?sort=reverselastlogin",
|
|
"/explore/users?sort=leastupdate",
|
|
"/explore/users?sort=reverseleastupdate",
|
|
}
|
|
for _, c := range cases404 {
|
|
req := NewRequest(t, "GET", c).SetHeader("Accept", "text/html")
|
|
MakeRequest(t, req, http.StatusNotFound)
|
|
}
|
|
}
|