external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: secure access to comment edits to user who owns the comment

Browse source 
Found along with the previous commit to be a security hole in our
implementation. This commit resolves an issue regarding comment editing.

Signed-off-by: Kevin Morris <kevr@0cost.org>
This commit is contained in:
Kevin Morris 2022-08-15 14:49:34 -07:00
parent 7a52da5587
commit 15d016eb70
No known key found for this signature in database
GPG key ID: F7E46DED420788F3
2 changed files with 18 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

16
test/test_pkgbase_routes.py
View file

@ -467,6 +467,22 @@ def test_pkgbase_comments(client: TestClient, maintainer: User, user: User,
assert "form" in data
def test_pkgbase_comment_edit_unauthorized(client: TestClient,
user: User,
maintainer: User,
package: Package,
comment: PackageComment):
pkgbase = package.PackageBase
cookies = {"AURSID": maintainer.login(Request(), "testPassword")}
with client as request:
endp = f"/pkgbase/{pkgbase.Name}/comments/{comment.ID}"
response = request.post(endp, data={
"comment": "abcd im trying to change this comment."
}, cookies=cookies)
assert response.status_code == HTTPStatus.UNAUTHORIZED
def test_pkgbase_comment_delete(client: TestClient,
maintainer: User,
user: User,