mirrors/wallabag
1
0
Fork 0
mirror of https://github.com/wallabag/wallabag.git synced 2024-12-23 16:10:28 +00:00
Code Issues Projects Releases Wiki Activity

Fix permission to settings page

Browse source
This commit is contained in:
Jeremy Benoist 2016-01-22 18:48:04 +01:00
parent 1c7d66645b
commit 07c9b1c98a
2 changed files with 33 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/config/security.yml
View file

@ -57,5 +57,5 @@ security:
- { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: /(unread|starred|archive).xml$, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/, roles: ROLE_USER }
- { path: ^/settings, roles: ROLE_SUPER_ADMIN }
- { path: ^/, roles: ROLE_USER }

32
src/Wallabag/CoreBundle/Tests/Controller/SettingsControllerTest.php Normal file
View file

@ -0,0 +1,32 @@
<?php
namespace Wallabag\CoreBundle\Tests\Controller;
use Wallabag\CoreBundle\Tests\WallabagCoreTestCase;
/**
* The controller `SettingsController` does not exist.
* This test cover security against the internal settings page managed by CraueConfigBundle
*/
class SettingsControllerTest extends WallabagCoreTestCase
{
public function testSettingsWithAdmin()
{
$this->logInAs('admin');
$client = $this->getClient();
$crawler = $client->request('GET', '/settings');
$this->assertEquals(200, $client->getResponse()->getStatusCode());
}
public function testSettingsWithNormalUser()
{
$this->logInAs('bob');
$client = $this->getClient();
$crawler = $client->request('GET', '/settings');
$this->assertEquals(403, $client->getResponse()->getStatusCode());
}
}