96
96
self.assertThat(observed, MatchesListwise(expected))
99
class TestXSSBugs(MAASServerTestCase):
100
"""Tests for making sure we don't allow cross-site scripting bugs."""
102
def test_invalid_signature_response_is_textplain(self):
103
response = self.client.get(
104
reverse('nodes_handler'),
105
{'op': '<script>alert(document.domain)</script>'})
106
self.assertIn("text/plain", response.get("Content-Type"))
107
self.assertNotIn("text/html", response.get("Content-Type"))
99
110
class TestStoreNodeParameters(MAASServerTestCase):
100
111
"""Tests for `store_node_power_parameters`."""
586
597
class TestNodeGroupInterfaceAPIAccessPermissions(APITestCase):
587
# The nodegroup worker must have access because it amends the
588
# foreign_dhcp_ip property. Normal users do not have access.
598
# The nodegroup worker must have access to report_foreign_dhcp.
599
# Normal users do not have access.
590
601
def test_read_does_not_work_for_normal_user(self):
591
602
nodegroup = NodeGroup.objects.ensure_master()
711
722
NodeGroupInterface.objects.filter(
712
723
interface=interface.interface, nodegroup=nodegroup).exists())
714
def test_update_foreign_dhcp_ip_sets_value(self):
725
def test_report_foreign_dhcp_sets_value(self):
715
726
self.become_admin()
716
727
nodegroup = factory.make_node_group()
717
728
[interface] = nodegroup.get_managed_interfaces()
718
729
ip = factory.getRandomIPAddress()
719
response = self.client_put(
730
response = self.client.post(
721
732
'nodegroupinterface_handler',
722
733
args=[nodegroup.uuid, interface.interface]),
735
'op': 'report_foreign_dhcp',
724
736
'foreign_dhcp_ip': ip,
726
738
self.assertEqual(httplib.OK, response.status_code)
727
739
self.assertEqual(ip, reload_object(interface).foreign_dhcp_ip)
729
def test_update_foreign_dhcp_ip_unsets_value(self):
741
def test_report_foreign_dhcp_unsets_value(self):
730
742
self.become_admin()
731
743
nodegroup = factory.make_node_group()
732
744
[interface] = nodegroup.get_managed_interfaces()
733
745
interface.foreign_dhcp_ip = factory.getRandomIPAddress()
735
response = self.client_put(
747
response = self.client.post(
737
749
'nodegroupinterface_handler',
738
750
args=[nodegroup.uuid, interface.interface]),
752
'op': 'report_foreign_dhcp',
740
753
'foreign_dhcp_ip': '',
742
755
self.assertEqual(httplib.OK, response.status_code)