This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/allura.git
commit e154040e099cbad0749f7831a691c334da2245f1 Author: Dave Brondsema <[email protected]> AuthorDate: Tue May 5 12:01:35 2026 -0400 [#8603] test to know forgeblog/main.py setattr loop is ok --- ForgeBlog/forgeblog/tests/functional/test_root.py | 29 +++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/ForgeBlog/forgeblog/tests/functional/test_root.py b/ForgeBlog/forgeblog/tests/functional/test_root.py index 7e8bc735e..b5c5ccd24 100644 --- a/ForgeBlog/forgeblog/tests/functional/test_root.py +++ b/ForgeBlog/forgeblog/tests/functional/test_root.py @@ -23,6 +23,7 @@ from allura.lib import helpers as h from alluratest.controller import TestController +from forgeblog import model as BM class Test(TestController): @@ -252,6 +253,34 @@ def test_post_bad_url_params(self): d = self._blog_date() self.app.get('/blog/%s/my-post/?limit=blah&page=2x' % d, status=200) + def test_save_ignores_non_form_fields(self): + """Mass assignment: extra POST params must not overwrite model fields outside the form""" + self._post() + d = self._blog_date() + post_url = '/blog/%s/my-post/save' % d + + post = BM.BlogPost.query.find().first() + original_slug = post.slug + original_app_config_id = post.app_config_id + + # Attempt to inject fields not defined in EditPostForm + self.app.post(post_url, params={ + 'title': 'My Post', + 'text': 'Updated text', + 'labels': '', + 'state': 'published', + 'slug': 'hacked-slug', + 'deleted': 'True', + 'app_config_id': 'deadbeefdeadbeefdeadbeef', + }) + + post = BM.BlogPost.query.find({'slug': original_slug}).first() + assert post is not None, "post should still be findable by its original slug" + assert post.text == 'Updated text' # standard fields should be updated + assert post.slug == original_slug + assert post.deleted is False + assert post.app_config_id == original_app_config_id + def test_rate_limit_submit(self): with h.push_config(tg.config, **{'forgeblog.rate_limits': '{"3600": 0}'}): r = self._post()
