25 lines
1 KiB
Python
25 lines
1 KiB
Python
"""Régressions sur les protections des requêtes qui écrivent."""
|
|
from app_new.config import DevelopmentConfig
|
|
|
|
|
|
def test_csrf_is_enabled_in_remote_development():
|
|
assert DevelopmentConfig.WTF_CSRF_ENABLED is True
|
|
|
|
|
|
def test_login_post_without_csrf_is_rejected_when_enabled(client, app):
|
|
previous = app.config["WTF_CSRF_ENABLED"]
|
|
app.config["WTF_CSRF_ENABLED"] = True
|
|
try:
|
|
response = client.post("/auth/login", data={"username": "inconnu", "password": "inconnu"})
|
|
assert response.status_code == 400
|
|
finally:
|
|
app.config["WTF_CSRF_ENABLED"] = previous
|
|
|
|
|
|
def test_mutating_routes_reject_get(client):
|
|
assert client.get("/equipments/1/status/hs").status_code == 405
|
|
assert client.get("/pronote/sync-salles").status_code == 405
|
|
assert client.get("/pronote/disconnect").status_code == 405
|
|
assert client.get("/outlook/api/sync-folders/1").status_code == 405
|
|
assert client.get("/outlook/api/sync-mails/1").status_code == 405
|
|
assert client.get("/outlook/api/sync-attachments/inconnu").status_code == 405
|