13 Commits (5dbb78fe79f51bce9934cdd7d07959d67bf362bb)

Author	SHA1	Message	Date
Oliver Günther	a6b4372b09	Always preprocess URLs with CGI.unescape ... This forces redirect URLs to always pass through the escaping process, in order to process escaped paths (`/mysubdir/%2E%2E/secret/`).	9 years ago
Oliver Günther	fcd450af3f	Fix redirect vulnerability ... `redirect_back_or_default` was vulnerable to some of the URLs found to be vulnerable in redmine, such as `@test.foo`. This commit extracts the whole functionality into a policy and alters the constraints with a path check to avoid these cases. Thanks to @marutosi for pointing this out. http://www.redmine.org/projects/redmine/repository/revisions/14560	9 years ago
Alex Coles	ce93701029	Fix syntax (w/Rubocop) in specs ... Signed-off-by: Alex Coles <alex@alexbcoles.com>	10 years ago
Alex Coles	3785fdc9ed	Use #describe, #context with String arg not symbol ... The semantics of `describe` have changed in RSpec 3: passing a symbol rather than a string will change the value of the described object. See discussion here: https://github.com/rspec/rspec-core/issues/1114 Signed-off-by: Alex Coles <alex@alexbcoles.com>	10 years ago
Alex Coles	944b89d83e	Convert specs to RSpec 3.2.0 syntax with Transpec ... This conversion is done by Transpec 3.0.7 with the following command: transpec -f * 34 conversions from: it { should ... } to: it { is_expected.to ... } * 14 conversions from: obj.stub_chain(:message1, :message2) to: allow(obj).to receive_message_chain(:message1, :message2) * 7 conversions from: obj.stub(:message) to: allow(obj).to receive(:message) * 4 conversions from: be_true to: be_truthy * 3 conversions from: obj.should_receive(:message) to: expect(obj).to receive(:message) * 2 conversions from: failure_message_for_should { } to: failure_message { } * 2 conversions from: failure_message_for_should_not { } to: failure_message_when_negated { } * 1 conversion from: Klass.any_instance.stub(:message => value) to: allow_any_instance_of(Klass).to receive_messages(:message => value) * 1 conversion from: be_false to: be_falsey * 1 conversion from: obj.should_not_receive(:message) to: expect(obj).not_to receive(:message) * 1 conversion from: stub('something') to: double('something') * 1 addition of: RSpec.configure { |c| c.infer_spec_type_from_file_location! } For more details: https://github.com/yujinakayama/transpec#supported-conversions	10 years ago
Alex Coles	e0191e759c	Update year in copyright header to 2015 ... [ci skip]	10 years ago
Alex Coles	5afc11f19e	Fix syntax (w/Rubocop) in specs ... Signed-off-by: Alex Coles <alex@alexbcoles.com>	10 years ago
Hagen Schink	478b2c8859	Test manage subtasks policy	10 years ago
Philipp Tessenow	d7d1158d15	add specs for QueryPolicy:show	10 years ago
Hagen Schink	5d08947580	Test correct query deletion verb	10 years ago
Jens Ulferts	f7d92b156e	fixes permission links on query	10 years ago
Jens Ulferts	4817547d4a	introduces policies ... The pattern used here is taken from pundit although this here does by far not have the functionality pundit offers.	10 years ago