cartodb4/Windshaft-cartodb
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Prevent unauthenticated requests from changing map styles

Browse Source
This commit is contained in:
Sandro Santilli 2012-08-07 17:10:15 +02:00
parent 6a92fd3170
commit 282ac94e29
2 changed files with 33 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lib/cartodb/cartodb_windshaft.js
View File

@ -37,8 +37,7 @@ var CartodbWindshaft = function(serverOptions) {
else that.afterStateChange(req, data, callback); else that.afterStateChange(req, data, callback);
}); });
} else { } else {
console.log("WARNING: map style changed by unauthenticated request!"); callback(new Error("map style cannot be changed by unauthenticated request!"));
this.afterStateChange(req, data, callback);
} }
} }
@ -53,8 +52,7 @@ var CartodbWindshaft = function(serverOptions) {
else that.afterStateChange(req, data, callback); else that.afterStateChange(req, data, callback);
}); });
} else { } else {
console.log("WARNING: map style deleted by unauthenticated request!"); callback(new Error("map style cannot be deleted by unauthenticated request!"));
this.afterStateChange(req, data, callback);
} }
} }

36
test/acceptance/server.js
View File

@ -65,10 +65,10 @@ suite('server', function() {
body: JSON.stringify([ 'style.mss:1:11 Unrecognized rule: backgxxxxxround-color', 'style.mss:1:38 Unrecognized rule: foo' ]) body: JSON.stringify([ 'style.mss:1:11 Unrecognized rule: backgxxxxxround-color', 'style.mss:1:38 Unrecognized rule: foo' ])
}, function() { done(); }); }, function() { done(); });
}); });
test("post'ing good style returns 200", function(done){ test("post'ing good style returns 200", function(done){
assert.response(server, { assert.response(server, {
url: '/tiles/my_table5/style', url: '/tiles/my_table5/style?map_key=1234',
method: 'POST', method: 'POST',
headers: {host: 'vizzuality.localhost.lan', 'Content-Type': 'application/x-www-form-urlencoded' }, headers: {host: 'vizzuality.localhost.lan', 'Content-Type': 'application/x-www-form-urlencoded' },
data: querystring.stringify({style: 'Map {background-color:#fff;}'}) data: querystring.stringify({style: 'Map {background-color:#fff;}'})
@ -78,11 +78,25 @@ suite('server', function() {
done(); done();
}); });
}); });
test("post'ing good style with no authentication returns an error", function(done){
assert.response(server, {
url: '/tiles/my_table5/style',
method: 'POST',
headers: {host: 'vizzuality.localhost.lan', 'Content-Type': 'application/x-www-form-urlencoded' },
data: querystring.stringify({style: 'Map {background-color:#fff;}'})
},{}, function(res) {
// fixme: we should really return a 403 here
assert.equal(res.statusCode, 500, res.body);
assert.ok(res.body.indexOf('map style cannot be changed by unauthenticated request') != -1, res.body);
done();
});
});
test("post'ing good style returns 200 then getting returns original style", function(done){ test("post'ing good style returns 200 then getting returns original style", function(done){
var style = 'Map {background-color:#fff;}'; var style = 'Map {background-color:#fff;}';
assert.response(server, { assert.response(server, {
url: '/tiles/my_table5/style', url: '/tiles/my_table5/style?map_key=1234',
method: 'POST', method: 'POST',
headers: {host: 'vizzuality.localhost.lan', 'Content-Type': 'application/x-www-form-urlencoded' }, headers: {host: 'vizzuality.localhost.lan', 'Content-Type': 'application/x-www-form-urlencoded' },
data: querystring.stringify({style: style}) data: querystring.stringify({style: style})
@ -104,8 +118,20 @@ suite('server', function() {
}); });
// TODO: test that unauthenticated DELETE should fail // Test that unauthenticated DELETE should fail
// See https://github.com/Vizzuality/cartodb-management/issues/155 // See https://github.com/Vizzuality/cartodb-management/issues/155
test("delete'ing style with no authentication returns an error", function(done){
assert.response(server, {
url: '/tiles/my_table5/style',
method: 'DELETE',
headers: {host: 'vizzuality'},
},{}, function(res) {
// fixme: we should really return a 403 here
assert.equal(res.statusCode, 500, res.body);
assert.ok(res.body.indexOf('map style cannot be deleted by unauthenticated request') != -1, res.body);
done();
});
});
test("delete'ing style returns 200 then getting returns default style", function(done){ test("delete'ing style returns 200 then getting returns default style", function(done){
// this is the default style // this is the default style
@ -113,7 +139,7 @@ suite('server', function() {
assert.response(server, { assert.response(server, {
url: '/tiles/my_table5/style?map_key=1234', url: '/tiles/my_table5/style?map_key=1234',
method: 'DELETE', method: 'DELETE',
headers: {host: 'localhost'}, headers: {host: 'vizzuality'},
},{}, function(res) { },{}, function(res) {
assert.equal(res.statusCode, 200, res.body); assert.equal(res.statusCode, 200, res.body);