eBooru/test/functional/post_replacements_controller_test.rb

170 lines
5.7 KiB
Ruby
Raw Permalink Normal View History

# frozen_string_literal: true
require "test_helper"
Raise error on unpermitted params. Fail loudly if we forget to whitelist a param instead of silently ignoring it. misc models: convert to strong params. artist commentaries: convert to strong params. * Disallow changing or setting post_id to a nonexistent post. artists: convert to strong params. * Disallow setting `is_banned` in create/update actions. Changing it this way instead of with the ban/unban actions would leave the artist in a partially banned state. bans: convert to strong params. * Disallow changing the user_id after the ban has been created. comments: convert to strong params. favorite groups: convert to strong params. news updates: convert to strong params. post appeals: convert to strong params. post flags: convert to strong params. * Disallow users from setting the `is_deleted` / `is_resolved` flags. ip bans: convert to strong params. user feedbacks: convert to strong params. * Disallow users from setting `disable_dmail_notification` when creating feedbacks. * Disallow changing the user_id after the feedback has been created. notes: convert to strong params. wiki pages: convert to strong params. * Also fix non-Builders being able to delete wiki pages. saved searches: convert to strong params. pools: convert to strong params. * Disallow setting `post_count` or `is_deleted` in create/update actions. janitor trials: convert to strong params. post disapprovals: convert to strong params. * Factor out quick-mod bar to shared partial. * Fix quick-mod bar to use `Post#is_approvable?` to determine visibility of Approve button. dmail filters: convert to strong params. password resets: convert to strong params. user name change requests: convert to strong params. posts: convert to strong params. users: convert to strong params. * Disallow setting password_hash, last_logged_in_at, last_forum_read_at, has_mail, and dmail_filter_attributes[user_id]. * Remove initialize_default_image_size (dead code). uploads: convert to strong params. * Remove `initialize_status` because status already defaults to pending in the database. tag aliases/implications: convert to strong params. tags: convert to strong params. forum posts: convert to strong params. * Disallow changing the topic_id after creating the post. * Disallow setting is_deleted (destroy/undelete actions should be used instead). * Remove is_sticky / is_locked (nonexistent attributes). forum topics: convert to strong params. * merges https://github.com/evazion/danbooru/tree/wip-rails-5.1 * lock pg gem to 0.21 (1.0.0 is incompatible with rails 5.1.4) * switch to factorybot and change all references Co-authored-by: r888888888 <r888888888@gmail.com> Co-authored-by: evazion <noizave@gmail.com> add diffs
2018-04-02 13:51:26 -04:00
class PostReplacementsControllerTest < ActionDispatch::IntegrationTest
context "The post replacements controller" do
setup do
Raise error on unpermitted params. Fail loudly if we forget to whitelist a param instead of silently ignoring it. misc models: convert to strong params. artist commentaries: convert to strong params. * Disallow changing or setting post_id to a nonexistent post. artists: convert to strong params. * Disallow setting `is_banned` in create/update actions. Changing it this way instead of with the ban/unban actions would leave the artist in a partially banned state. bans: convert to strong params. * Disallow changing the user_id after the ban has been created. comments: convert to strong params. favorite groups: convert to strong params. news updates: convert to strong params. post appeals: convert to strong params. post flags: convert to strong params. * Disallow users from setting the `is_deleted` / `is_resolved` flags. ip bans: convert to strong params. user feedbacks: convert to strong params. * Disallow users from setting `disable_dmail_notification` when creating feedbacks. * Disallow changing the user_id after the feedback has been created. notes: convert to strong params. wiki pages: convert to strong params. * Also fix non-Builders being able to delete wiki pages. saved searches: convert to strong params. pools: convert to strong params. * Disallow setting `post_count` or `is_deleted` in create/update actions. janitor trials: convert to strong params. post disapprovals: convert to strong params. * Factor out quick-mod bar to shared partial. * Fix quick-mod bar to use `Post#is_approvable?` to determine visibility of Approve button. dmail filters: convert to strong params. password resets: convert to strong params. user name change requests: convert to strong params. posts: convert to strong params. users: convert to strong params. * Disallow setting password_hash, last_logged_in_at, last_forum_read_at, has_mail, and dmail_filter_attributes[user_id]. * Remove initialize_default_image_size (dead code). uploads: convert to strong params. * Remove `initialize_status` because status already defaults to pending in the database. tag aliases/implications: convert to strong params. tags: convert to strong params. forum posts: convert to strong params. * Disallow changing the topic_id after creating the post. * Disallow setting is_deleted (destroy/undelete actions should be used instead). * Remove is_sticky / is_locked (nonexistent attributes). forum topics: convert to strong params. * merges https://github.com/evazion/danbooru/tree/wip-rails-5.1 * lock pg gem to 0.21 (1.0.0 is incompatible with rails 5.1.4) * switch to factorybot and change all references Co-authored-by: r888888888 <r888888888@gmail.com> Co-authored-by: evazion <noizave@gmail.com> add diffs
2018-04-02 13:51:26 -04:00
@user = create(:moderator_user, can_approve_posts: true, created_at: 1.month.ago)
@regular_user = create(:member_user, replacements_beta: true, created_at: 1.month.ago)
2022-11-26 09:25:27 -05:00
as(@user) do
@upload = UploadService.new(attributes_for(:jpg_upload).merge({ uploader: @user })).start!
@post = @upload.post
@replacement = create(:png_replacement, creator: @user, post: @post)
Raise error on unpermitted params. Fail loudly if we forget to whitelist a param instead of silently ignoring it. misc models: convert to strong params. artist commentaries: convert to strong params. * Disallow changing or setting post_id to a nonexistent post. artists: convert to strong params. * Disallow setting `is_banned` in create/update actions. Changing it this way instead of with the ban/unban actions would leave the artist in a partially banned state. bans: convert to strong params. * Disallow changing the user_id after the ban has been created. comments: convert to strong params. favorite groups: convert to strong params. news updates: convert to strong params. post appeals: convert to strong params. post flags: convert to strong params. * Disallow users from setting the `is_deleted` / `is_resolved` flags. ip bans: convert to strong params. user feedbacks: convert to strong params. * Disallow users from setting `disable_dmail_notification` when creating feedbacks. * Disallow changing the user_id after the feedback has been created. notes: convert to strong params. wiki pages: convert to strong params. * Also fix non-Builders being able to delete wiki pages. saved searches: convert to strong params. pools: convert to strong params. * Disallow setting `post_count` or `is_deleted` in create/update actions. janitor trials: convert to strong params. post disapprovals: convert to strong params. * Factor out quick-mod bar to shared partial. * Fix quick-mod bar to use `Post#is_approvable?` to determine visibility of Approve button. dmail filters: convert to strong params. password resets: convert to strong params. user name change requests: convert to strong params. posts: convert to strong params. users: convert to strong params. * Disallow setting password_hash, last_logged_in_at, last_forum_read_at, has_mail, and dmail_filter_attributes[user_id]. * Remove initialize_default_image_size (dead code). uploads: convert to strong params. * Remove `initialize_status` because status already defaults to pending in the database. tag aliases/implications: convert to strong params. tags: convert to strong params. forum posts: convert to strong params. * Disallow changing the topic_id after creating the post. * Disallow setting is_deleted (destroy/undelete actions should be used instead). * Remove is_sticky / is_locked (nonexistent attributes). forum topics: convert to strong params. * merges https://github.com/evazion/danbooru/tree/wip-rails-5.1 * lock pg gem to 0.21 (1.0.0 is incompatible with rails 5.1.4) * switch to factorybot and change all references Co-authored-by: r888888888 <r888888888@gmail.com> Co-authored-by: evazion <noizave@gmail.com> add diffs
2018-04-02 13:51:26 -04:00
end
end
context "create action" do
2020-11-15 09:42:36 -05:00
should "accept new non duplicate replacement" do
file = fixture_file_upload("alpha.png")
params = {
format: :json,
post_id: @post.id,
post_replacement: {
2020-11-15 09:42:36 -05:00
replacement_file: file,
reason: "test replacement",
as_pending: true,
},
}
assert_difference(-> { @post.replacements.size }) do
Raise error on unpermitted params. Fail loudly if we forget to whitelist a param instead of silently ignoring it. misc models: convert to strong params. artist commentaries: convert to strong params. * Disallow changing or setting post_id to a nonexistent post. artists: convert to strong params. * Disallow setting `is_banned` in create/update actions. Changing it this way instead of with the ban/unban actions would leave the artist in a partially banned state. bans: convert to strong params. * Disallow changing the user_id after the ban has been created. comments: convert to strong params. favorite groups: convert to strong params. news updates: convert to strong params. post appeals: convert to strong params. post flags: convert to strong params. * Disallow users from setting the `is_deleted` / `is_resolved` flags. ip bans: convert to strong params. user feedbacks: convert to strong params. * Disallow users from setting `disable_dmail_notification` when creating feedbacks. * Disallow changing the user_id after the feedback has been created. notes: convert to strong params. wiki pages: convert to strong params. * Also fix non-Builders being able to delete wiki pages. saved searches: convert to strong params. pools: convert to strong params. * Disallow setting `post_count` or `is_deleted` in create/update actions. janitor trials: convert to strong params. post disapprovals: convert to strong params. * Factor out quick-mod bar to shared partial. * Fix quick-mod bar to use `Post#is_approvable?` to determine visibility of Approve button. dmail filters: convert to strong params. password resets: convert to strong params. user name change requests: convert to strong params. posts: convert to strong params. users: convert to strong params. * Disallow setting password_hash, last_logged_in_at, last_forum_read_at, has_mail, and dmail_filter_attributes[user_id]. * Remove initialize_default_image_size (dead code). uploads: convert to strong params. * Remove `initialize_status` because status already defaults to pending in the database. tag aliases/implications: convert to strong params. tags: convert to strong params. forum posts: convert to strong params. * Disallow changing the topic_id after creating the post. * Disallow setting is_deleted (destroy/undelete actions should be used instead). * Remove is_sticky / is_locked (nonexistent attributes). forum topics: convert to strong params. * merges https://github.com/evazion/danbooru/tree/wip-rails-5.1 * lock pg gem to 0.21 (1.0.0 is incompatible with rails 5.1.4) * switch to factorybot and change all references Co-authored-by: r888888888 <r888888888@gmail.com> Co-authored-by: evazion <noizave@gmail.com> add diffs
2018-04-02 13:51:26 -04:00
post_auth post_replacements_path, @user, params: params
@post.reload
2017-11-20 19:29:59 -05:00
end
assert_equal @response.parsed_body["location"], post_path(@post)
end
context "with as_pending false" do
should "immediately approve a replacement" do
file = fixture_file_upload("alpha.png")
params = {
format: :json,
post_id: @post.id,
post_replacement: {
replacement_file: file,
reason: "test replacement",
as_pending: false,
},
}
post_auth post_replacements_path, @user, params: params
@post.reload
# 200be2be97a465ecd2054a51522f65b5 is the md5 of alpha.png
assert_equal "200be2be97a465ecd2054a51522f65b5", @post.md5
assert_equal @response.parsed_body["location"], post_path(@post)
end
should "always upload as pending if user can't approve posts" do
file = fixture_file_upload("test.gif")
params = {
format: :json,
post_id: @post.id,
post_replacement: {
replacement_file: file,
reason: "test replacement",
as_pending: false,
},
}
post_auth post_replacements_path, @regular_user, params: params
@post.reload
# 1e2edf6bdbd971d8c3cc4da0f98f38ab is the md5 of test.gif
assert_not_equal "1e2edf6bdbd971d8c3cc4da0f98f38ab", @post.md5
assert_equal @response.parsed_body["location"], post_path(@post)
end
end
context "with a previously destroyed post" do
setup do
@admin = create(:admin_user)
as(@admin) do
@replacement.destroy
@upload2 = UploadService.new(attributes_for(:png_upload).merge({ uploader: @user })).start!
@post2 = @upload2.post
@post2.expunge!
end
end
should "fail and create ticket" do
assert_difference({ "PostReplacement.count" => 0, "Ticket.count" => 1 }) do
file = fixture_file_upload("test.png")
post_auth post_replacements_path, @user, params: { post_id: @post.id, post_replacement: { replacement_file: file, reason: "test replacement" }, format: :json }
Rails.logger.debug PostReplacement.all.map(&:md5).join(", ")
end
end
should "fail and not create ticket if notify=false" do
DestroyedPost.find_by!(post_id: @post2.id).update_column(:notify, false)
assert_difference(%(Post.count Ticket.count), 0) do
file = fixture_file_upload("test.png")
post_auth post_replacements_path, @user, params: { post_id: @post.id, post_replacement: { replacement_file: file, reason: "test replacement" }, format: :json }
end
end
end
end
context "reject action" do
should "reject replacement" do
put_auth reject_post_replacement_path(@replacement), @user
assert_redirected_to post_path(@post)
@replacement.reload
@post.reload
assert_equal @replacement.status, "rejected"
assert_not_equal @post.md5, @replacement.md5
end
end
context "approve action" do
should "replace post" do
put_auth approve_post_replacement_path(@replacement), @user
2020-11-15 09:42:36 -05:00
assert_redirected_to post_path(@post)
@replacement.reload
@post.reload
assert_equal @replacement.md5, @post.md5
assert_equal @replacement.status, "approved"
end
end
context "promote action" do
should "create post" do
post_auth promote_post_replacement_path(@replacement), @user
last_post = Post.last
assert_redirected_to post_path(last_post)
@replacement.reload
@post.reload
assert_equal @replacement.md5, last_post.md5
assert_equal @replacement.status, "promoted"
end
end
context "toggle action" do
should "change penalize_uploader flag" do
put_auth approve_post_replacement_path(@replacement, penalize_current_uploader: true), @user
@replacement.reload
assert @replacement.penalize_uploader_on_approve
put_auth toggle_penalize_post_replacement_path(@replacement), @user
assert_redirected_to post_replacement_path(@replacement)
@replacement.reload
assert_not @replacement.penalize_uploader_on_approve
end
end
2020-11-15 09:42:36 -05:00
context "index action" do
should "render" do
get post_replacements_path
assert_response :success
end
end
2020-11-15 09:42:36 -05:00
context "new action" do
should "render" do
get_auth new_post_replacement_path, @user, params: { post_id: @post.id }
assert_response :success
end
end
end
end