webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-07-28 17:02:04 +03:00
Code Activity

Finished off script CSP rules

Browse Source 
- Added caching for custom html head parsing to add nonce.
- Also moved api docs page into web routes to prevent issues.
This commit is contained in:
Dan Brown
2021-09-04 13:57:04 +01:00
parent fd44e4ba74
commit 253f386f00
13 changed files with 248 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
tests/Api/ApiDocsTest.php
View File

@ -2,7 +2,6 @@
namespace Tests\Api;
use BookStack\Auth\User;
use Tests\TestCase;
class ApiDocsTest extends TestCase
@ -11,16 +10,6 @@ class ApiDocsTest extends TestCase
protected $endpoint = '/api/docs';
public function test_docs_page_not_visible_to_normal_viewers()
{
$viewer = $this->getViewer();
$resp = $this->actingAs($viewer)->get($this->endpoint);
$resp->assertStatus(403);
$resp = $this->actingAsApiEditor()->get($this->endpoint);
$resp->assertStatus(200);
}
public function test_docs_page_returns_view_with_docs_content()
{
$resp = $this->actingAsApiEditor()->get($this->endpoint);
@ -42,19 +31,4 @@ class ApiDocsTest extends TestCase
]],
]);
}
public function test_docs_page_visible_by_public_user_if_given_permission()
{
$this->setSettings(['app-public' => true]);
$guest = User::getDefault();
$this->startSession();
$resp = $this->get('/api/docs');
$resp->assertStatus(403);
$this->giveUserPermissions($guest, ['access-api']);
$resp = $this->get('/api/docs');
$resp->assertStatus(200);
}
}