X-Git-Url: https://git.openstreetmap.org/rails.git/blobdiff_plain/ef7f3d800cbdd49b692df10d312e5fd880e2e938..19a9298855028b3edb95428d34470f45c92ce8d9:/test/controllers/node_controller_test.rb diff --git a/test/controllers/node_controller_test.rb b/test/controllers/node_controller_test.rb index 8fb6d8e16..0cfc2267c 100644 --- a/test/controllers/node_controller_test.rb +++ b/test/controllers/node_controller_test.rb @@ -1,4 +1,4 @@ -require 'test_helper' +require "test_helper" class NodeControllerTest < ActionController::TestCase api_fixtures @@ -39,7 +39,7 @@ class NodeControllerTest < ActionController::TestCase changeset = changesets(:normal_user_first_change) # create a minimal xml file content("") - assert_difference('OldNode.count', 0) do + assert_difference("OldNode.count", 0) do put :create end # hope for unauthorized @@ -55,7 +55,7 @@ class NodeControllerTest < ActionController::TestCase changeset = changesets(:normal_user_first_change) # create a minimal xml file content("") - assert_difference('Node.count', 0) do + assert_difference("Node.count", 0) do put :create end # hope for success @@ -194,14 +194,12 @@ class NodeControllerTest < ActionController::TestCase # in a way... content(nodes(:used_node_1).to_xml) delete :delete, :id => current_nodes(:used_node_1).id - assert_require_public_data - "shouldn't be able to delete a node used in a way (#{@response.body})" + assert_require_public_data "shouldn't be able to delete a node used in a way (#{@response.body})" # in a relation... content(nodes(:node_used_by_relationship).to_xml) delete :delete, :id => current_nodes(:node_used_by_relationship).id - assert_require_public_data - "shouldn't be able to delete a node used in a relation (#{@response.body})" + assert_require_public_data "shouldn't be able to delete a node used in a relation (#{@response.body})" ## now set auth for the public data user basic_authorization(users(:public_user).email, "test") @@ -300,19 +298,19 @@ class NodeControllerTest < ActionController::TestCase assert_require_public_data("update with changeset=0 should be forbidden, when data isn't public") ## try and submit invalid updates - content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lat', 91.0) + content xml_attr_rewrite(current_nodes(:visible_node).to_xml, "lat", 91.0) put :update, :id => current_nodes(:visible_node).id assert_require_public_data "node at lat=91 should be forbidden, when data isn't public" - content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lat', -91.0) + content xml_attr_rewrite(current_nodes(:visible_node).to_xml, "lat", -91.0) put :update, :id => current_nodes(:visible_node).id assert_require_public_data "node at lat=-91 should be forbidden, when data isn't public" - content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lon', 181.0) + content xml_attr_rewrite(current_nodes(:visible_node).to_xml, "lon", 181.0) put :update, :id => current_nodes(:visible_node).id assert_require_public_data "node at lon=181 should be forbidden, when data isn't public" - content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lon', -181.0) + content xml_attr_rewrite(current_nodes(:visible_node).to_xml, "lon", -181.0) put :update, :id => current_nodes(:visible_node).id assert_require_public_data "node at lon=-181 should be forbidden, when data isn't public" @@ -352,19 +350,19 @@ class NodeControllerTest < ActionController::TestCase assert_response :conflict, "update with changeset=0 should be rejected" ## try and submit invalid updates - content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lat', 91.0) + content xml_attr_rewrite(current_nodes(:visible_node).to_xml, "lat", 91.0) put :update, :id => current_nodes(:visible_node).id assert_response :bad_request, "node at lat=91 should be rejected" - content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lat', -91.0) + content xml_attr_rewrite(current_nodes(:visible_node).to_xml, "lat", -91.0) put :update, :id => current_nodes(:visible_node).id assert_response :bad_request, "node at lat=-91 should be rejected" - content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lon', 181.0) + content xml_attr_rewrite(current_nodes(:visible_node).to_xml, "lon", 181.0) put :update, :id => current_nodes(:visible_node).id assert_response :bad_request, "node at lon=181 should be rejected" - content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lon', -181.0) + content xml_attr_rewrite(current_nodes(:visible_node).to_xml, "lon", -181.0) put :update, :id => current_nodes(:visible_node).id assert_response :bad_request, "node at lon=-181 should be rejected" @@ -373,19 +371,19 @@ class NodeControllerTest < ActionController::TestCase # try and submit a version behind content xml_attr_rewrite(current_nodes(:visible_node).to_xml, - 'version', current_node_version - 1) + "version", current_node_version - 1) put :update, :id => current_nodes(:visible_node).id assert_response :conflict, "should have failed on old version number" # try and submit a version ahead content xml_attr_rewrite(current_nodes(:visible_node).to_xml, - 'version', current_node_version + 1) + "version", current_node_version + 1) put :update, :id => current_nodes(:visible_node).id assert_response :conflict, "should have failed on skipped version number" # try and submit total crap in the version field content xml_attr_rewrite(current_nodes(:visible_node).to_xml, - 'version', 'p1r4t3s!') + "version", "p1r4t3s!") put :update, :id => current_nodes(:visible_node).id assert_response :conflict, "should not be able to put 'p1r4at3s!' in the version field" @@ -444,8 +442,8 @@ class NodeControllerTest < ActionController::TestCase # add an identical tag to the node tag_xml = XML::Node.new("tag") - tag_xml['k'] = current_node_tags(:public_v_t1).k - tag_xml['v'] = current_node_tags(:public_v_t1).v + tag_xml["k"] = current_node_tags(:public_v_t1).k + tag_xml["v"] = current_node_tags(:public_v_t1).v # add the tag into the existing xml node_xml = current_nodes(:public_visible_node).to_xml @@ -468,8 +466,8 @@ class NodeControllerTest < ActionController::TestCase # try and put something into a string that the API might # use unquoted and therefore allow code injection... content "" + - '' + - '' + '' + + "" put :create assert_require_public_data "Shouldn't be able to create with non-public user" @@ -480,8 +478,8 @@ class NodeControllerTest < ActionController::TestCase # try and put something into a string that the API might # use unquoted and therefore allow code injection... content "" + - '' + - '' + '' + + "" put :create assert_response :success nodeid = @response.body @@ -498,21 +496,13 @@ class NodeControllerTest < ActionController::TestCase # check the tags are not corrupted assert_equal checknode.tags, apinode.tags - assert apinode.tags.include?('#{@user.inspect}') - end - - def basic_authorization(user, pass) - @request.env["HTTP_AUTHORIZATION"] = "Basic %s" % Base64.encode64("#{user}:#{pass}") - end - - def content(c) - @request.env["RAW_POST_DATA"] = c.to_s + assert apinode.tags.include?("\#{@user.inspect}") end ## # update the changeset_id of a node element def update_changeset(xml, changeset_id) - xml_attr_rewrite(xml, 'changeset', changeset_id) + xml_attr_rewrite(xml, "changeset", changeset_id) end ##