mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-08-07 15:28:45 +09:00
Jeremy Daer
49f06d0b22
- Including Authentication re-arms protect_from_forgery on DiskController.
Active Storage's direct-upload service PUT (#update) sends only signed
service headers and no CSRF token, so a real authenticated upload would
422 storing bytes. Re-exempt #update from forgery protection; the signed
URL token and session check still gate the write.
- Swap the raw skip_before_action for the Authentication concern's
intent-revealing allow_unauthenticated_access / allow_bot_access helpers
on #show, matching the rest of the app.
- Scope the test's ActiveStorage::Current.url_options override to a
set { } block so it can't leak thread-local state into later tests.
44 lines
1.2 KiB
Ruby
44 lines
1.2 KiB
Ruby
require "test_helper"
|
|
|
|
class ActiveStorage::DirectUploadsControllerTest < ActionDispatch::IntegrationTest
|
|
setup do
|
|
host! "once.campfire.test"
|
|
end
|
|
|
|
test "create requires authentication" do
|
|
assert_no_difference -> { ActiveStorage::Blob.count } do
|
|
post rails_direct_uploads_url, params: { blob: blob_params }
|
|
end
|
|
|
|
assert_redirected_to new_session_url
|
|
end
|
|
|
|
test "create succeeds for an authenticated session" do
|
|
sign_in :david
|
|
|
|
assert_difference -> { ActiveStorage::Blob.count }, 1 do
|
|
post rails_direct_uploads_url, params: { blob: blob_params }
|
|
end
|
|
|
|
assert_response :success
|
|
end
|
|
|
|
test "disk show stays reachable without authentication" do
|
|
blob = ActiveStorage::Blob.create_and_upload! \
|
|
io: StringIO.new("hello"), filename: "hello.txt", content_type: "text/plain"
|
|
|
|
ActiveStorage::Current.set(url_options: { host: "once.campfire.test", protocol: "http" }) do
|
|
get blob.url
|
|
end
|
|
|
|
assert_response :success
|
|
end
|
|
|
|
private
|
|
def blob_params
|
|
content = "hello"
|
|
{ filename: "hello.txt", byte_size: content.bytesize, content_type: "text/plain", \
|
|
checksum: Digest::MD5.base64digest(content) }
|
|
end
|
|
end
|