chinwag/chinwagsocial
chinwag/chinwagsocial
2
0
Fork 0
Code Issues Pull requests Releases 14 Wiki Activity

Merge pull request from GHSA-58x8-3qxw-6hm7

Browse source 
* Fix insufficient permission checking for public timeline endpoints

Note that this changes unauthenticated access failure code from 401 to 422

* Add more tests for public timelines

* Require user token in `/api/v1/statuses/:id/translate` and `/api/v1/scheduled_statuses`
This commit is contained in:
Claire 2024-07-04 16:26:49 +02:00 • committed by GitHub
commit 4fb4721072
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
8 changed files with 71 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

19
spec/controllers/api/v1/timelines/tag_controller_spec.rb
View file

@ -6,7 +6,8 @@ describe Api::V1::Timelines::TagController do
render_views
let(:user) { Fabricate(:user) }
let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read:statuses') }
let(:scopes) { 'read:statuses' }
let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
before do
allow(controller).to receive(:doorkeeper_token) { token }
@ -48,13 +49,23 @@ describe Api::V1::Timelines::TagController do
Form::AdminSettings.new(timeline_preview: false).save
end
context 'when the user is not authenticated' do
context 'without an access token' do
let(:token) { nil }
it 'returns http unauthorized' do
it 'returns http unprocessable entity' do
subject
expect(response).to have_http_status(401)
expect(response).to have_http_status(422)
end
end
context 'with an application access token, not bound to a user' do
let(:token) { Fabricate(:accessible_access_token, resource_owner_id: nil, scopes: scopes) }
it 'returns http unprocessable entity' do
subject
expect(response).to have_http_status(422)
end
end