gitea/tests/integration/explore_user_test.go
wxiaoguang 2b059f493e
Only use supported sort order for "explore/users" page (#29430) (#29443)
Backport #29430

Thanks to inferenceus : some sort orders on the "explore/users" page
could list users by their lastlogintime/updatetime.

It leaks user's activity unintentionally. This PR makes that page only
use "supported" sort orders.

Removing the "sort orders" could also be a good solution, while IMO at
the moment keeping the "create time" and "name" orders is also fine, in
case some users would like to find a target user in the search result,
the "sort order" might help.
2024-03-03 02:28:45 +00:00

46 lines
1.3 KiB
Go

// Copyright 2024 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT
package integration
import (
"net/http"
"testing"
"code.gitea.io/gitea/tests"
"github.com/stretchr/testify/assert"
)
func TestExploreUser(t *testing.T) {
defer tests.PrepareTestEnv(t)()
cases := []struct{ sortOrder, expected string }{
{"", "/explore/users?sort=newest&q="},
{"newest", "/explore/users?sort=newest&q="},
{"oldest", "/explore/users?sort=oldest&q="},
{"alphabetically", "/explore/users?sort=alphabetically&q="},
{"reversealphabetically", "/explore/users?sort=reversealphabetically&q="},
}
for _, c := range cases {
req := NewRequest(t, "GET", "/explore/users?sort="+c.sortOrder)
resp := MakeRequest(t, req, http.StatusOK)
h := NewHTMLParser(t, resp.Body)
href, _ := h.Find(`.ui.dropdown .menu a.active.item[href^="/explore/users"]`).Attr("href")
assert.Equal(t, c.expected, href)
}
// these sort orders shouldn't be supported, to avoid leaking user activity
cases404 := []string{
"/explore/users?sort=lastlogin",
"/explore/users?sort=reverselastlogin",
"/explore/users?sort=leastupdate",
"/explore/users?sort=reverseleastupdate",
}
for _, c := range cases404 {
req := NewRequest(t, "GET", c)
req.Header.Get("Accept: text/html")
MakeRequest(t, req, http.StatusNotFound)
}
}