mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-10-28 00:16:48 +09:00
Jeremy Daer
160ba295b5
A transfer link signed only the user id, so one copied before the password changed still started a session for up to four hours after. Bind it to the password salt with generates_token_for, so a new password ends those links too. Links made before this upgrade stop working; they last four hours at most.
34 lines
1.1 KiB
Ruby
34 lines
1.1 KiB
Ruby
require "test_helper"
|
|
|
|
class Sessions::TransfersControllerTest < ActionDispatch::IntegrationTest
|
|
test "show renders when not signed in" do
|
|
get session_transfer_url("some-token")
|
|
|
|
assert_response :success
|
|
assert_select "form[data-controller='auto-submit']", count: 1
|
|
assert_select "input[name='_method'][value='put']", count: 1
|
|
assert_equal response.body.scan(/<form\b/).size, response.body.scan("</form>").size
|
|
assert_match(/<form\b[^>]*data-controller="auto-submit"[^>]*>(?:\s*<input\b[^>]*>)*\s*<\/form>/, response.body)
|
|
end
|
|
|
|
test "update establishes a session when the code is valid" do
|
|
user = users(:david)
|
|
|
|
put session_transfer_url(user.transfer_id)
|
|
|
|
assert_redirected_to root_url
|
|
assert parsed_cookies.signed[:session_token]
|
|
end
|
|
|
|
test "update rejects a link made before the password changed" do
|
|
user = users(:david)
|
|
transfer_id = user.transfer_id
|
|
user.update!(password: "a new secret123456")
|
|
|
|
put session_transfer_url(transfer_id)
|
|
|
|
assert_response :bad_request
|
|
assert_nil parsed_cookies.signed[:session_token]
|
|
end
|
|
end
|