comparison MoinMoin/action/_tests/ @ 5098:ff588e9e24d6

simplify getAttachUrl: remove upload parameter upload=x didn't influence drawing url generation at all, for file url generation one can just give do='upload_form' if one wants the upload url. URL args for do='upload_form' were streamlined to use target=x instead of rename=x so it is more similar to the other code. Removed test for "tainted" file names in URLs. We must not "taint" file names for URLs. Filenames in URLs need to be url-quoted. If a URL is used in html, it needs to be escaped.
author Thomas Waldmann <tw AT waldmann-edv DOT de>
date Sun, 13 Sep 2009 00:06:04 +0200
parents e6190a499a7e
equal deleted inserted replaced
5096:c8ea1985d348 5098:ff588e9e24d6
64 64
65 nuke_page(self.request, self.pagename) 65 nuke_page(self.request, self.pagename)
66 66
67 assert file_exists 67 assert file_exists
68 68
69 def test_getAttachUrl(self):
70 """
71 Tests if AttachFile.getAttachUrl taints a filename
72 """
73 filename = "<test2.txt>"
74 expect = "rename=_test2.txt_"
75 result = AttachFile.getAttachUrl(self.pagename, filename, self.request, upload=True)
77 assert expect in result
79 coverage_modules = ['MoinMoin.action.AttachFile'] 69 coverage_modules = ['MoinMoin.action.AttachFile']