Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fix abuse of bugging login behavior with API URLs. 

(imported from commit 3009cd094dff8891da415e1bfcf596ea6cb38abc)
This commit is contained in:
Tim Abbott 2013-12-11 14:27:40 -05:00
parent 33cdf0d019
commit 0a952b1a66
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
zerver/tests.py
View File

@ -2833,9 +2833,11 @@ class GetSubscribersTest(AuthedTestCase):
stream_name, domain)] stream_name, domain)]
self.assertItemsEqual(result["subscribers"], true_subscribers) self.assertItemsEqual(result["subscribers"], true_subscribers)
def make_subscriber_request(self, stream_name): def make_subscriber_request(self, stream_name, email=None):
if email is None:
email = self.email
return self.client.get("/api/v1/streams/%s/members" % (stream_name,), return self.client.get("/api/v1/streams/%s/members" % (stream_name,),
**self.api_auth(self.email)) **self.api_auth(email))
def make_successful_subscriber_request(self, stream_name): def make_successful_subscriber_request(self, stream_name):
result = self.make_subscriber_request(stream_name) result = self.make_subscriber_request(stream_name)
@ -2939,14 +2941,13 @@ class GetSubscribersTest(AuthedTestCase):
A non-subscriber to a private stream can't query that stream's membership. A non-subscriber to a private stream can't query that stream's membership.
""" """
# Create a private stream for which Hamlet is the only subscriber. # Create a private stream for which Hamlet is the only subscriber.
stream_name = "Saxony" stream_name = "NewStream"
self.common_subscribe_to_streams(self.email, [stream_name], self.common_subscribe_to_streams(self.email, [stream_name],
invite_only=True) invite_only=True)
other_email = "othello@zulip.com" other_email = "othello@zulip.com"
# Try to fetch the subscriber list as a non-member. # Try to fetch the subscriber list as a non-member.
self.login(other_email) result = self.make_subscriber_request(stream_name, email=other_email)
result = self.make_subscriber_request(stream_name)
self.assert_json_error(result, self.assert_json_error(result,
"Unable to retrieve subscribers for invite-only stream") "Unable to retrieve subscribers for invite-only stream")