deac/instiki
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Security: HTTP GET Bypassed Spam Protection

Browse source 
Apparently, the form_spam_protect plugin only works with HTTP POST, not GET.
Unsafe operations (save and file-upload) should be POSTs anyway.
Fixed.

Also, two broken tests fixed. Only two Unit Tests now fail: both are minor bugs in XHTMLDiff.
This commit is contained in:
Jacques Distler 2007-10-07 01:59:50 -05:00
parent be8bb3d06d
commit 2484542f12
6 changed files with 22 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

8
test/unit/page_renderer_test.rb
View file

@ -181,9 +181,13 @@ class PageRendererTest < Test::Unit::TestCase
end
def test_content_with_pre_blocks
set_web_property :markup, :markdownMML
assert_markup_parsed_as(
'<p>A <code>class SmartEngine end</code> would not mark up </p>\n\n<pre>CodeBlocks</pre>\n\n<p>would it?</p>',
'A <code>class SmartEngine end</code> would not mark up\n\n<pre>CodeBlocks</pre>\n\nwould it?')
"<p>A <code>class SmartEngine</code> would not mark up</p>\n\n<pre><code>CodeBlocks</code></pre>\n\n<p>would it?</p>",
"A `class SmartEngine` would not mark up\n\n CodeBlocks\n\nwould it?")
assert_markup_parsed_as(
"<p>A <code>class SmartEngine</code> would not mark up</p>\n<pre>CodeBlocks</pre>\n<p>would it?</p>",
"A <code>class SmartEngine</code> would not mark up\n\n<pre>CodeBlocks</pre>\n\nwould it?")
end
# def test_content_with_autolink_in_parentheses