You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@allura.apache.org by je...@apache.org on 2015/03/06 13:35:12 UTC
[05/26] allura git commit: [#7832] ticket:731 Test for permissions
[#7832] ticket:731 Test for permissions
Project: http://git-wip-us.apache.org/repos/asf/allura/repo
Commit: http://git-wip-us.apache.org/repos/asf/allura/commit/a747991c
Tree: http://git-wip-us.apache.org/repos/asf/allura/tree/a747991c
Diff: http://git-wip-us.apache.org/repos/asf/allura/diff/a747991c
Branch: refs/heads/ib/7830
Commit: a747991c01a63399d28b10dd579559147022cfb5
Parents: f392d5b
Author: Igor Bondarenko <je...@gmail.com>
Authored: Mon Feb 23 10:34:35 2015 +0000
Committer: Dave Brondsema <db...@slashdotmedia.com>
Committed: Fri Feb 27 22:40:52 2015 +0000
----------------------------------------------------------------------
Allura/allura/tests/test_webhooks.py | 14 ++++++++++++++
1 file changed, 14 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/allura/blob/a747991c/Allura/allura/tests/test_webhooks.py
----------------------------------------------------------------------
diff --git a/Allura/allura/tests/test_webhooks.py b/Allura/allura/tests/test_webhooks.py
index 50a9803..a336f32 100644
--- a/Allura/allura/tests/test_webhooks.py
+++ b/Allura/allura/tests/test_webhooks.py
@@ -894,3 +894,17 @@ class TestWebhookRestController(TestRestApiBase):
dd.assert_equal(r.json, {u'result': u'ok'})
assert_equal(M.Webhook.query.find().count(), 2)
assert_equal(M.Webhook.query.get(_id=webhook._id), None)
+
+ def test_permissions(self):
+ self.api_get(self.url, user='test-user', status=403)
+ self.api_get(self.url, user='*anonymous', status=401)
+ url = self.url + '/repo-push/'
+ self.api_post(url, user='test-user', status=403)
+ self.api_post(url, user='*anonymous', status=401)
+ url = self.url + '/repo-push/' + str(self.webhooks[0]._id)
+ self.api_get(url, user='test-user', status=403)
+ self.api_get(url, user='*anonymous', status=401)
+ self.api_post(url, user='test-user', status=403)
+ self.api_post(url, user='*anonymous', status=401)
+ self.api_delete(url, user='test-user', status=403)
+ self.api_delete(url, user='*anonymous', status=401)