From 5644fffbc3c58e6dd7e3c4103c28bad8f4c0bbc6 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Thu, 6 Aug 2026 13:30:38 +0200 Subject: Let editors set a node external homepage, gated and witnessed --- test/models/node_test.rb | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) (limited to 'test/models/node_test.rb') diff --git a/test/models/node_test.rb b/test/models/node_test.rb index a34094a0..c7fee58e 100644 --- a/test/models/node_test.rb +++ b/test/models/node_test.rb @@ -1072,4 +1072,33 @@ class NodeTest < ActiveSupport::TestCase assert_not node.reload.in_trash? assert_equal club.id, node.parent_id end + + test "setting an external url is gated and witnessed" do + node = Node.root.children.create!(:slug => "chapter_url_test") + + assert_difference -> { NodeAction.where(:action => "node_external_url").count }, 1 do + assert node.update_external_url!("https://example.org", users(:aaron)) + end + + assert_equal "https://example.org", node.reload.external_url + entry = NodeAction.where(:action => "node_external_url").last + assert_equal({ "from" => nil, "to" => "https://example.org" }, + entry.metadata["external_url"]) + end + + test "a javascript url is refused" do + node = Node.root.children.create!(:slug => "chapter_url_reject") + assert_raises(ActiveRecord::RecordInvalid) do + node.update_external_url!("javascript:alert(1)", users(:aaron)) + end + end + + test "setting an external url on a restricted node needs redaktion" do + node = Node.find_by(:unique_name => "updates") || + Node.root.children.create!(:slug => "updates") + + assert_raises(ActiveRecord::RecordInvalid) do + node.update_external_url!("https://example.org", users(:quentin)) + end + end end -- cgit v1.3