add: defense-in-depth mechanism to prevent unauthorized adding of groups

[gigi.git] / tests / org / cacert / gigi / pages / admin / TestSEAdminPageDetails.java

diff --git a/tests/org/cacert/gigi/pages/admin/TestSEAdminPageDetails.java b/tests/org/cacert/gigi/pages/admin/TestSEAdminPageDetails.java
index 44c23535a9bfe5d8c422a754268fe85cbfb63ef3..e9b31abba12e6331f8e4f648b5ac0df8ff9ac612 100644 (file)
--- a/tests/org/cacert/gigi/pages/admin/TestSEAdminPageDetails.java
+++ b/tests/org/cacert/gigi/pages/admin/TestSEAdminPageDetails.java
@@ -9,7 +9,6 @@ import java.net.MalformedURLException;
 import java.net.URLConnection;
 import java.sql.Timestamp;
 import java.util.Locale;
-import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
 import org.cacert.gigi.GigiApiException;
@@ -28,8 +27,9 @@ import org.junit.Test;
 
 public class TestSEAdminPageDetails extends ClientTest {
 
-    public TestSEAdminPageDetails() throws IOException {
-        grant(email, Group.SUPPORTER);
+    public TestSEAdminPageDetails() throws IOException, GigiApiException {
+        grant(u, Group.SUPPORTER);
+        cookie = login(email, TEST_PASSWORD);
         assertEquals(302, post(cookie, SupportEnterTicketPage.PATH, "ticketno=a20140808.8&setTicket=action", 0).getResponseCode());
     }
 
@@ -39,7 +39,7 @@ public class TestSEAdminPageDetails extends ClientTest {
         String fname = "Först";
         String lname = "Secönd";
         int id = createVerifiedUser(fname, lname, email, TEST_PASSWORD);
-        URLConnection uc = get(SupportUserDetailsPage.PATH + id);
+        URLConnection uc = get(SupportUserDetailsPage.PATH + id + "/");
         uc.setDoOutput(true);
         String res = IOUtils.readURL(uc);
         assertThat(res, containsString(fname));
@@ -61,13 +61,13 @@ public class TestSEAdminPageDetails extends ClientTest {
         ea = EmailAddress.getById(ea.getId());
         assertTrue(ea.isVerified());
 
-        String res = IOUtils.readURL(get(SupportUserDetailsPage.PATH + id));
+        String res = IOUtils.readURL(get(SupportUserDetailsPage.PATH + id + "/"));
         assertEquals(2, countRegex(res, Pattern.quote(email)));
         assertEquals(1, countRegex(res, Pattern.quote(email2)));
 
         User.getById(id).updateDefaultEmail(ea);
         clearCaches();
-        res = IOUtils.readURL(get(SupportUserDetailsPage.PATH + id));
+        res = IOUtils.readURL(get(SupportUserDetailsPage.PATH + id + "/"));
         assertEquals(1, countRegex(res, Pattern.quote(email)));
         assertEquals(2, countRegex(res, Pattern.quote(email2)));
     }
@@ -83,27 +83,27 @@ public class TestSEAdminPageDetails extends ClientTest {
         assertEquals(0, logCountAdmin(id));
         assertEquals(0, logCountUser(clientCookie));
         // changing both leads to 2 entries
-        assertNull(executeBasicWebInteraction(cookie, SupportUserDetailsPage.PATH + id, "dobd=1&dobm=2&doby=2000&detailupdate", 0));
+        assertNull(executeBasicWebInteraction(cookie, SupportUserDetailsPage.PATH + id + "/", "dobd=1&dobm=2&doby=2000&detailupdate", 0));
         assertEquals(1, logCountAdmin(id));
         assertEquals(1, logCountUser(clientCookie));
 
         // Sending same data keeps same
-        assertNull(executeBasicWebInteraction(cookie, SupportUserDetailsPage.PATH + id, "dobd=1&dobm=2&doby=2000&detailupdate", 0));
+        assertNull(executeBasicWebInteraction(cookie, SupportUserDetailsPage.PATH + id + "/", "dobd=1&dobm=2&doby=2000&detailupdate", 0));
         assertEquals(1, logCountAdmin(id));
         assertEquals(1, logCountUser(clientCookie));
 
         // changing one leads to one entry
-        assertNull(executeBasicWebInteraction(cookie, SupportUserDetailsPage.PATH + id, "dobd=1&dobm=3&doby=2000&detailupdate", 0));
+        assertNull(executeBasicWebInteraction(cookie, SupportUserDetailsPage.PATH + id + "/", "dobd=1&dobm=3&doby=2000&detailupdate", 0));
         assertEquals(2, logCountAdmin(id));
         assertEquals(2, logCountUser(clientCookie));
 
         // changing one leads to one entry
-        assertNull(executeBasicWebInteraction(cookie, SupportUserDetailsPage.PATH + id, "dobd=2&dobm=3&doby=2000&detailupdate", 0));
+        assertNull(executeBasicWebInteraction(cookie, SupportUserDetailsPage.PATH + id + "/", "dobd=2&dobm=3&doby=2000&detailupdate", 0));
         assertEquals(3, logCountAdmin(id));
         assertEquals(3, logCountUser(clientCookie));
 
         // changing none -> no entry
-        assertNull(executeBasicWebInteraction(cookie, SupportUserDetailsPage.PATH + id, "dobd=2&dobm=3&doby=2000&detailupdate", 0));
+        assertNull(executeBasicWebInteraction(cookie, SupportUserDetailsPage.PATH + id + "/", "dobd=2&dobm=3&doby=2000&detailupdate", 0));
         assertEquals(3, logCountAdmin(id));
         assertEquals(3, logCountUser(clientCookie));
 
@@ -174,13 +174,4 @@ public class TestSEAdminPageDetails extends ClientTest {
         return c;
     }
 
-    private String getFname(String res) {
-        Pattern p = Pattern.compile("<span class='fname'>([^<]*)</span>");
-        Matcher m = p.matcher(res);
-        if (m.find()) {
-            return m.group(1);
-        }
-        return null;
-    }
-
 }