webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-08-09 10:22:51 +03:00
Code Activity

Updated API session auth to consider public access setting

Browse Source 
For #3091
This commit is contained in:
Dan Brown
2021-11-30 13:55:56 +00:00
parent b4fa82e329
commit 3b3eb0f44f
2 changed files with 31 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
tests/Api/ApiAuthTest.php
View File

@@ -3,6 +3,7 @@
namespace Tests\Api;
use BookStack\Auth\Permissions\RolePermission;
use BookStack\Auth\Role;
use BookStack\Auth\User;
use Carbon\Carbon;
use Tests\TestCase;
@@ -91,6 +92,26 @@ class ApiAuthTest extends TestCase
$resp->assertJson($this->errorResponse('The owner of the used API token does not have permission to make API calls', 403));
}
public function test_access_prevented_for_guest_users_with_api_permission_while_public_access_disabled()
{
$this->disableCookieEncryption();
$publicRole = Role::getSystemRole('public');
$accessApiPermission = RolePermission::getByName('access-api');
$publicRole->attachPermission($accessApiPermission);
$this->withCookie('bookstack_session', 'abc123');
// Test API access when not public
setting()->put('app-public', false);
$resp = $this->get($this->endpoint);
$resp->assertStatus(403);
// Test API access when public
setting()->put('app-public', true);
$resp = $this->get($this->endpoint);
$resp->assertStatus(200);
}
public function test_token_expiry_checked()
{
$editor = $this->getEditor();