This is an automated email from the ASF dual-hosted git repository.
sebb pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-ponymail-foal.git
The following commit(s) were added to refs/heads/master by this push:
new 1a8026d Add some access checks
1a8026d is described below
commit 1a8026d3cf13efadff3b1271416b173c3be5a484
Author: Sebb <[email protected]>
AuthorDate: Fri Jan 28 13:27:37 2022 +0000
Add some access checks
---
test/itest_integration.py | 70 +++++++++++++++++++++++++++++++++++++++++++++--
1 file changed, 67 insertions(+), 3 deletions(-)
diff --git a/test/itest_integration.py b/test/itest_integration.py
index d1199ba..549deea 100644
--- a/test/itest_integration.py
+++ b/test/itest_integration.py
@@ -39,6 +39,64 @@ def get_cookies(user='user'):
print(jzon['login']['credentials'])
return cookies
+def check_access(email, cookies):
+ # check email accessibility
+ mid = email['mid']
+ res = requests.get(
+ f"{API_BASE}/email.lua",
+ params={"id": mid},
+ cookies=cookies
+ )
+ assert res.status_code == 200
+ jzon = res.json()
+ assert mid == jzon['mid']
+ assert mid in jzon['permalinks']
+ # check email access by message-id
+ msgid = jzon['message-id']
+ listid = jzon['list_raw']
+ res = requests.get(
+ f"{API_BASE}/email.lua",
+ params={"id": msgid, "listid": listid},
+ cookies=cookies
+ )
+ assert res.status_code == 200
+ if email['private']:
+ # should not be visible without cookies
+ res = requests.get(
+ f"{API_BASE}/email.lua",
+ params={"id": mid}
+ )
+ assert res.status_code == 404
+ res = requests.get(
+ f"{API_BASE}/email.lua",
+ params={"id": msgid, "listid": listid}
+ )
+ assert res.status_code == 404
+ # check source accessibility
+ res = requests.get(
+ f"{API_BASE}/source.lua",
+ params={"id": mid},
+ cookies=cookies
+ )
+ assert res.status_code == 200
+ res = requests.get(
+ f"{API_BASE}/source.lua",
+ params={"id": msgid, "listid": listid},
+ cookies=cookies
+ )
+ assert res.status_code == 200
+ if email['private']:
+ # should not be visible without cookies
+ res = requests.get(
+ f"{API_BASE}/source.lua",
+ params={"id": mid}
+ )
+ assert res.status_code == 404
+ res = requests.get(
+ f"{API_BASE}/source.lua",
+ params={"id": msgid, "listid": listid}
+ )
+ assert res.status_code == 404
def test_lists():
jzon = requests.get(f"{API_BASE}/preferences").json()
@@ -46,10 +104,12 @@ def test_lists():
lists = jzon['lists']
assert 'ponymail.apache.org' in lists
assert 'users' in lists['ponymail.apache.org']
+ assert len(lists) == 1 # only expecting one domain
def test_public_stats():
jzon = requests.get(
-
f"{API_BASE}/stats.lua?list=users&domain=ponymail.apache.org&emailsOnly&d=gte=0d",
+ f"{API_BASE}/stats.lua",
+ params={"list": 'users', "domain": 'ponymail.apache.org',
"emailsOnly": True, "d": 'gte=0d'}
).json()
assert jzon['firstYear'] == 2022
assert jzon['firstMonth'] == 1
@@ -61,9 +121,11 @@ def test_public_stats():
assert email['list'] == email['list_raw']
assert email['id'] == email['mid']
assert email['private'] == False
+ check_access(email, None)
# Check we cannot see the private emails
jzon = requests.get(
-
f"{API_BASE}/stats.lua?list=users&domain=ponymail.apache.org&emailsOnly&d=2019-09"
+ f"{API_BASE}/stats.lua",
+ params={"list": 'users', "domain": 'ponymail.apache.org',
"emailsOnly": True, "d": '2019-09'}
).json()
assert jzon['hits'] == 0
@@ -71,7 +133,8 @@ def test_private_stats():
cookies = get_cookies('user')
# only fetch the private mail stats
jzon = requests.get(
-
f"{API_BASE}/stats.lua?list=users&domain=ponymail.apache.org&emailsOnly&d=2019-09",
+ f"{API_BASE}/stats.lua",
+ params={"list": 'users', "domain": 'ponymail.apache.org',
"emailsOnly": True, "d": '2019-09'},
cookies=cookies
).json()
# The earlier mails are private
@@ -85,3 +148,4 @@ def test_private_stats():
assert email['list'] == email['list_raw']
assert email['id'] == email['mid']
assert email['private']
+ check_access(email, cookies)
