zware/awx
1
0
Fork 0
mirror of https://github.com/ZwareBear/awx.git synced 2026-04-27 18:31:47 -05:00
Code Issues Packages Projects Releases Wiki Activity

prohibit order_by= for sensitive fields

Browse Source 
see: #5526
This commit is contained in:
Ryan Petrello
2017-02-23 15:22:08 -05:00
parent 053ecd1093
commit f4d4c43d94
3 changed files with 45 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
awx/main/tests/functional/api/test_inventory.py
View File

@@ -35,6 +35,21 @@ def test_edit_inventory(put, inventory, alice, role_field, expected_status_code)
put(reverse('api:inventory_detail', args=(inventory.id,)), data, alice, expect=expected_status_code)
@pytest.mark.parametrize('order_by', ('script', '-script', 'script,pk', '-script,pk'))
@pytest.mark.django_db
def test_list_cannot_order_by_unsearchable_field(get, organization, alice, order_by):
for i, script in enumerate(('#!/bin/a', '#!/bin/b', '#!/bin/c')):
custom_script = organization.custom_inventory_scripts.create(
name="I%d" % i,
script=script
)
custom_script.admin_role.members.add(alice)
response = get(reverse('api:inventory_script_list'), alice,
QUERY_STRING='order_by=%s' % order_by, status=400)
assert response.status_code == 400
@pytest.mark.parametrize("role_field,expected_status_code", [
(None, 403),
('admin_role', 201),