UploadPermissionPageTest Class Reference

Test for UploadPermissionPage::insertPermission(), covering the broken upload membership check fix @runTestsInSeparateProcesses @preserveGlobalState disabled. More...

Inheritance diagram for UploadPermissionPageTest:

Collaboration diagram for UploadPermissionPageTest:

Public Member Functions
	testRejectsUploadNotInAccessibleList ()
	testGrantsPermissionForUploadInAccessibleList ()
	testRejectsWhenAccessibleListIsEmpty ()

Protected Member Functions
	setUp ()
	tearDown ()

Private Member Functions
	accessibleUploadList ()

Private Attributes
	$assertCountBefore
	$page

Detailed Description

Test for UploadPermissionPage::insertPermission(), covering the broken upload membership check fix @runTestsInSeparateProcesses @preserveGlobalState disabled.

Regression coverage for: insertPermission() must confirm the target upload id is actually present in the caller's accessible upload list, not merely that the list is non-empty. Before the fix, the loop only checked truthiness of each entry's own upload_pk, so any non-empty but unrelated list let the caller change permissions on an arbitrary upload id they were never shown to have access to.

Definition at line 32 of file UploadPermissionPageTest.php.

Member Function Documentation

testGrantsPermissionForUploadInAccessibleList()

UploadPermissionPageTest::testGrantsPermissionForUploadInAccessibleList

(

)

Test:

1. Call insertPermission() for an upload id that genuinely is one of the entries in the accessible upload list.
2. Check that the permission is granted for that exact upload id.

Definition at line 106 of file UploadPermissionPageTest.php.

testRejectsUploadNotInAccessibleList()

UploadPermissionPageTest::testRejectsUploadNotInAccessibleList

(

)

Test:

1. Call insertPermission() for an upload id that is not present in the caller's accessible upload list, only unrelated ids are.
2. Check that it throws instead of granting the permission. This is the exact scenario from the reported vulnerability, a non-empty but unrelated list must not authorize an arbitrary upload id.

Definition at line 85 of file UploadPermissionPageTest.php.

testRejectsWhenAccessibleListIsEmpty()

UploadPermissionPageTest::testRejectsWhenAccessibleListIsEmpty

(

)

Test:

1. Call insertPermission() with an empty accessible upload list.
2. Check that it still throws, the pre-existing empty-list guard must keep working after the fix.

Definition at line 127 of file UploadPermissionPageTest.php.

---

The documentation for this class was generated from the following file:

• src/www/ui_tests/Unit/UploadPermissionPageTest.php