26 lines
1 KiB
Python
26 lines
1 KiB
Python
|
"""Régressions sur les protections des requêtes qui écrivent."""
|
||
|
|
from app_new.config import DevelopmentConfig
|
||
|
|
|
||
|
|
|
||
|
|
def test_csrf_is_enabled_in_remote_development():
|
||
|
|
assert DevelopmentConfig.WTF_CSRF_ENABLED is True
|
||
|
|
|
||
|
|
|
||
|
|
def test_login_post_without_csrf_is_rejected_when_enabled(client, app):
|
||
|
|
previous = app.config["WTF_CSRF_ENABLED"]
|
||
|
|
app.config["WTF_CSRF_ENABLED"] = True
|
||
|
|
try:
|
||
|
|
response = client.post("/auth/login", data={"username": "inconnu", "password": "inconnu"})
|
||
|
|
assert response.status_code == 400
|
||
|
|
finally:
|
||
|
|
app.config["WTF_CSRF_ENABLED"] = previous
|
||
|
|
|
||
|
|
|
||
|
|
def test_mutating_routes_reject_get(client):
|
||
|
|
assert client.get("/equipments/1/status/hs").status_code == 405
|
||
|
|
assert client.get("/pronote/sync-salles").status_code == 405
|
||
|
|
assert client.get("/pronote/disconnect").status_code == 405
|
||
|
|
assert client.get("/outlook/api/sync-folders/1").status_code == 405
|
||
|
|
assert client.get("/outlook/api/sync-mails/1").status_code == 405
|
||
|
|
assert client.get("/outlook/api/sync-attachments/inconnu").status_code == 405
|