From 5967f8e4e62fb9fc939b3197654e35c9fb49aafe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Buclin?= Date: Wed, 31 Aug 2011 19:57:33 +0200 Subject: [PATCH 01/34] Remove the now useless selenium_server_start.t script --- config/selenium_server_start.t | 7 ------- 1 file changed, 7 deletions(-) delete mode 100644 config/selenium_server_start.t diff --git a/config/selenium_server_start.t b/config/selenium_server_start.t deleted file mode 100644 index 6f25980..0000000 --- a/config/selenium_server_start.t +++ /dev/null @@ -1,7 +0,0 @@ -use strict; -use warnings; -use Alien::SeleniumRC; - -print "Starting The Selenium Server\n"; -Alien::SeleniumRC::start(); - From 469af66a3fe75102bd647496d78512c981961f83 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Buclin?= Date: Thu, 22 Sep 2011 01:54:02 +0200 Subject: [PATCH 02/34] New QA script for the strict isolation feature, see bug 309681 --- t/test_strict_isolation.t | 144 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 144 insertions(+) create mode 100644 t/test_strict_isolation.t diff --git a/t/test_strict_isolation.t b/t/test_strict_isolation.t new file mode 100644 index 0000000..2652ed9 --- /dev/null +++ b/t/test_strict_isolation.t @@ -0,0 +1,144 @@ +use strict; +use warnings; +use lib qw(lib); + +use Test::More "no_plan"; + +use QA::Util; + +my ($sel, $config) = get_selenium(); +my $qa_user = $config->{QA_Selenium_TEST_user_login}; +my $no_privs_user = $config->{unprivileged_user_login}; + +log_in($sel, $config, 'admin'); +set_parameters($sel, { "Group Security" => {"strict_isolation-on" => undef} }); + +# Restrict the bug to the "Master" group, so that we can check that only +# allowed people can be CC'ed to the bug. + +file_bug_in_product($sel, 'Another Product'); +$sel->select_ok("component", "label=c2"); +$sel->select_ok("version", "label=Another2"); +my $bug_summary = "Test isolation"; +$sel->type_ok("short_desc", $bug_summary); +$sel->type_ok("comment", "Unallowed users refused"); +my $master_gid = $sel->get_attribute('//input[@type="checkbox" and @name="groups" and @value="Master"]@id'); +$sel->check_ok($master_gid); +$master_gid =~ s/group_//; +$sel->click_ok('commit'); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +my $bug1_id = $sel->get_value('//input[@name="id" and @type="hidden"]'); +$sel->title_like(qr/^Bug $bug1_id Submitted/, "Bug $bug1_id created"); + +# At that point, CANEDIT is off and so everybody can be CC'ed to the bug. + +$sel->click_ok("cc_edit_area_showhide"); +$sel->type_ok("newcc", "$qa_user, $no_privs_user"); +$sel->click_ok("commit"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("Bug $bug1_id processed"); +go_to_bug($sel, $bug1_id); +$sel->click_ok("cc_edit_area_showhide"); +$sel->add_selection_ok("cc", "label=$no_privs_user"); +$sel->add_selection_ok("cc", "label=$qa_user"); +$sel->check_ok("removecc"); +$sel->click_ok("commit"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("Bug $bug1_id processed"); + +# Now enable CANEDIT for the "Master" group. This will enable strict isolation +# for the product. + +edit_product($sel, "Another Product"); +$sel->click_ok("link=Edit Group Access Controls:"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("Edit Group Controls for Another Product"); +$sel->check_ok("canedit_$master_gid"); +$sel->click_ok("submit"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("Update group access controls for Another Product"); + +# Non-members can no longer be CC'ed to the bug. + +go_to_bug($sel, $bug1_id); +$sel->click_ok("cc_edit_area_showhide"); +$sel->type_ok("newcc", $no_privs_user); +$sel->click_ok("commit"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("Invalid User Group"); +$sel->is_text_present_ok("User '$no_privs_user' is not able to edit the 'Another Product' Product"); +$sel->go_back_ok(); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_like(qr/^Bug $bug1_id /); +$sel->click_ok("cc_edit_area_showhide"); +$sel->type_ok("newcc", $qa_user); +$sel->click_ok("commit"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("Invalid User Group"); +$sel->is_text_present_ok("User '$qa_user' is not able to edit the 'Another Product' Product"); + +# Now set QA_Selenium_TEST user as a member of the Master group. + +go_to_admin($sel); +$sel->click_ok("link=Users"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("Search users"); +$sel->type_ok("matchstr", $qa_user); +$sel->select_ok("matchtype", "label=exact (find this user)"); +$sel->click_ok("search"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("Edit user QA-Selenium-TEST <$qa_user>"); +$sel->check_ok("group_$master_gid"); +$sel->click_ok("update"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("User $qa_user updated"); + +# The QA_Selenium_TEST user can now be CC'ed to the bug. + +go_to_bug($sel, $bug1_id); +$sel->click_ok("cc_edit_area_showhide"); +$sel->type_ok("newcc", $qa_user); +$sel->click_ok("commit"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("Bug $bug1_id processed"); +go_to_bug($sel, $bug1_id); +$sel->click_ok("cc_edit_area_showhide"); +$sel->add_selection_ok("cc", "label=$qa_user"); +$sel->check_ok("removecc"); +$sel->click_ok("commit"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("Bug $bug1_id processed"); + +# The powerless user still cannot be CC'ed. + +go_to_bug($sel, $bug1_id); +$sel->click_ok("cc_edit_area_showhide"); +$sel->type_ok("newcc", "$qa_user, $no_privs_user"); +$sel->click_ok("commit"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("Invalid User Group"); +$sel->is_text_present_ok("User '$no_privs_user' is not able to edit the 'Another Product' Product"); + +go_to_admin($sel); +$sel->click_ok("link=Users"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("Search users"); +$sel->type_ok("matchstr", $qa_user); +$sel->select_ok("matchtype", "label=exact (find this user)"); +$sel->click_ok("search"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("Edit user QA-Selenium-TEST <$qa_user>"); +$sel->uncheck_ok("group_$master_gid"); +$sel->click_ok("update"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("User $qa_user updated"); + +edit_product($sel, "Another Product"); +$sel->click_ok("link=Edit Group Access Controls:"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("Edit Group Controls for Another Product"); +$sel->uncheck_ok("canedit_$master_gid"); +$sel->click_ok("submit"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("Update group access controls for Another Product"); +logout($sel); From c82e2392f4fffee7e2c20a72a629e41962acc73e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Buclin?= Date: Thu, 22 Sep 2011 18:42:48 +0200 Subject: [PATCH 03/34] New QA script to test some of the security features of Bugzilla. To start with, the "allow_attachment_display" parameter, see bug 472206 --- t/test_security.t | 51 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 t/test_security.t diff --git a/t/test_security.t b/t/test_security.t new file mode 100644 index 0000000..505030f --- /dev/null +++ b/t/test_security.t @@ -0,0 +1,51 @@ +use strict; +use warnings; +use lib qw(lib); + +use Test::More "no_plan"; + +use QA::Util; + +my ($sel, $config) = get_selenium(); + +log_in($sel, $config, 'admin'); +set_parameters($sel, { "Attachments" => {"allow_attachment_display-off" => undef} }); + +file_bug_in_product($sel, "TestProduct"); +my $bug_summary = "Security checks"; +$sel->type_ok("short_desc", $bug_summary); +$sel->type_ok("comment", "This bug will be used to test security fixes."); +$sel->type_ok("data", "/var/www/html/selenium/bugzilla/patch.diff"); +$sel->type_ok("description", "simple patch, v1"); +$sel->click_ok("ispatch"); +$sel->click_ok('commit'); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +my $bug1_id = $sel->get_value('//input[@name="id" and @type="hidden"]'); +$sel->title_like(qr/Bug $bug1_id /, "Bug $bug1_id created"); + +# Attachments are not viewable. + +$sel->click_ok("link=Details"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_like(qr/Attachment \d+ Details for Bug $bug1_id/); +$sel->is_text_present_ok("The attachment is not viewable in your browser due to security restrictions"); +$sel->click_ok("link=View"); +# Wait 1 second to give the browser a chance to display the attachment. +# Do not use wait_for_page_to_load_ok() as the File Saver will never go away. +sleep(1); +$sel->title_like(qr/Attachment \d+ Details for Bug $bug1_id/); +ok(!$sel->is_text_present('@@'), "Patch not displayed"); + +# Enable viewing attachments. + +set_parameters($sel, { "Attachments" => {"allow_attachment_display-on" => undef} }); + +go_to_bug($sel, $bug1_id); +$sel->click_ok('link=simple patch, v1'); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is(""); +$sel->is_text_present_ok('@@'); +$sel->go_back_ok(); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_like(qr/Bug $bug1_id /); +logout($sel); From a39c71665b55a35a6f3ee0e79085356f1c183a33 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Buclin?= Date: Thu, 22 Sep 2011 20:15:03 +0200 Subject: [PATCH 04/34] Bug 472362: Malicious attachments can change your user settings --- t/test_security.t | 52 ++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 51 insertions(+), 1 deletion(-) diff --git a/t/test_security.t b/t/test_security.t index 505030f..37993f5 100644 --- a/t/test_security.t +++ b/t/test_security.t @@ -6,7 +6,57 @@ use Test::More "no_plan"; use QA::Util; -my ($sel, $config) = get_selenium(); +my ($sel, $config) = get_selenium(CHROME_MODE); +my $urlbase = $config->{bugzilla_installation}; +my $admin_user = $config->{admin_user_login}; + +####################################################################### +# Security bug 472362. +####################################################################### + +log_in($sel, $config, 'admin'); +$sel->click_ok("link=Preferences"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("User Preferences"); +my $admin_cookie = $sel->get_value("token"); +logout($sel); + +log_in($sel, $config, 'editbugs'); +$sel->click_ok("link=Preferences"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("User Preferences"); +my $editbugs_cookie = $sel->get_value("token"); + +# Using our own unused token is fine. + +$sel->open_ok("/$urlbase/userprefs.cgi?dosave=1&display_quips=off&token=$editbugs_cookie"); +$sel->title_is("User Preferences"); +$sel->is_text_present_ok("The changes to your general preferences have been saved"); + +# Reusing a token must fail. They must all trigger the Suspicious Action warning. + +my @args = ("", "token=", "token=i123x", "token=$admin_cookie", "token=$editbugs_cookie"); + +foreach my $arg (@args) { + $sel->open_ok("/$urlbase/userprefs.cgi?dosave=1&display_quips=off&$arg"); + $sel->title_is("Suspicious Action"); + + if ($arg eq "token=$admin_cookie") { + $sel->is_text_present_ok("Generated by: admin <$admin_user>"); + $sel->is_text_present_ok("This token has not been generated by you"); + } + else { + $sel->is_text_present_ok("It looks like you didn't come from the right page"); + } +} +logout($sel); + +####################################################################### +# Security bug 472206. +# Keep this test as the very last one as the File Saver will remain +# open till the end of the script. Selenium is currently* unable +# to interact with it and close it (* = 2.6.0). +####################################################################### log_in($sel, $config, 'admin'); set_parameters($sel, { "Attachments" => {"allow_attachment_display-off" => undef} }); From 6729231aeb7248dab3820de2cb6a069e53b4ed3b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Buclin?= Date: Fri, 23 Sep 2011 01:39:44 +0200 Subject: [PATCH 05/34] Bug 38862: attachments should be at a different hostname --- t/test_security.t | 71 ++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 58 insertions(+), 13 deletions(-) diff --git a/t/test_security.t b/t/test_security.t index 37993f5..37087f0 100644 --- a/t/test_security.t +++ b/t/test_security.t @@ -10,11 +10,67 @@ my ($sel, $config) = get_selenium(CHROME_MODE); my $urlbase = $config->{bugzilla_installation}; my $admin_user = $config->{admin_user_login}; +# Let's create a bug and attachment to play with. + +log_in($sel, $config, 'admin'); +file_bug_in_product($sel, "TestProduct"); +my $bug_summary = "Security checks"; +$sel->type_ok("short_desc", $bug_summary); +$sel->type_ok("comment", "This bug will be used to test security fixes."); +$sel->type_ok("data", "/var/www/html/selenium/bugzilla/patch.diff"); +$sel->type_ok("description", "simple patch, v1"); +$sel->click_ok("ispatch"); +$sel->click_ok('commit'); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +my $bug1_id = $sel->get_value('//input[@name="id" and @type="hidden"]'); +$sel->title_like(qr/Bug $bug1_id /, "Bug $bug1_id created"); + + +####################################################################### +# Security bug 38862. +####################################################################### + +# No alternate host for attachments; cookies will be accessible. + +set_parameters($sel, { "Attachments" => {"allow_attachment_display-on" => undef, + "reset-attachment_base" => undef} }); + +go_to_bug($sel, $bug1_id); +$sel->click_ok("link=simple patch, v1"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is(""); +my @cookies = split(/[\s;]+/, $sel->get_cookie()); +my $nb_cookies = scalar @cookies; +ok($nb_cookies, "Found $nb_cookies cookies:\n" . join("\n", @cookies)); +ok(!$sel->is_cookie_present("Bugzilla_login"), "Bugzilla_login not accessible"); +ok(!$sel->is_cookie_present("Bugzilla_logincookie"), "Bugzilla_logincookie not accessible"); +$sel->go_back_ok(); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_like(qr/^Bug $bug1_id /); + +# Alternate host for attachments; no cookie should be accessible. + +set_parameters($sel, { "Attachments" => {"attachment_base" => {type => "text", + value => "http://127.0.0.1/$urlbase/"}} }); +go_to_bug($sel, $bug1_id); +$sel->click_ok("link=simple patch, v1"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is(""); +@cookies = split(/[\s;]+/, $sel->get_cookie()); +$nb_cookies = scalar @cookies; +ok(!$nb_cookies, "No cookies found"); +ok(!$sel->is_cookie_present("Bugzilla_login"), "Bugzilla_login not accessible"); +ok(!$sel->is_cookie_present("Bugzilla_logincookie"), "Bugzilla_logincookie not accessible"); +$sel->go_back_ok(); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_like(qr/^Bug $bug1_id /); + +set_parameters($sel, { "Attachments" => {"reset-attachment_base" => undef} }); + ####################################################################### # Security bug 472362. ####################################################################### -log_in($sel, $config, 'admin'); $sel->click_ok("link=Preferences"); $sel->wait_for_page_to_load_ok(WAIT_TIME); $sel->title_is("User Preferences"); @@ -61,20 +117,9 @@ logout($sel); log_in($sel, $config, 'admin'); set_parameters($sel, { "Attachments" => {"allow_attachment_display-off" => undef} }); -file_bug_in_product($sel, "TestProduct"); -my $bug_summary = "Security checks"; -$sel->type_ok("short_desc", $bug_summary); -$sel->type_ok("comment", "This bug will be used to test security fixes."); -$sel->type_ok("data", "/var/www/html/selenium/bugzilla/patch.diff"); -$sel->type_ok("description", "simple patch, v1"); -$sel->click_ok("ispatch"); -$sel->click_ok('commit'); -$sel->wait_for_page_to_load_ok(WAIT_TIME); -my $bug1_id = $sel->get_value('//input[@name="id" and @type="hidden"]'); -$sel->title_like(qr/Bug $bug1_id /, "Bug $bug1_id created"); - # Attachments are not viewable. +go_to_bug($sel, $bug1_id); $sel->click_ok("link=Details"); $sel->wait_for_page_to_load_ok(WAIT_TIME); $sel->title_like(qr/Attachment \d+ Details for Bug $bug1_id/); From 5c3f65fbb8c54f3c42de5bf7afaec0ff22256055 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Buclin?= Date: Fri, 23 Sep 2011 23:51:00 +0200 Subject: [PATCH 06/34] Bug 319466: Make sure boolean charts work correctly with comment + commenter fields and pronoun substitution --- t/lib/QA/Util.pm | 20 ++++++++++++++++++ t/test_search.t | 54 +++++++++++++++++++++++++++++++++++++++++------- 2 files changed, 66 insertions(+), 8 deletions(-) diff --git a/t/lib/QA/Util.pm b/t/lib/QA/Util.pm index 26e3712..7f0bb88 100644 --- a/t/lib/QA/Util.pm +++ b/t/lib/QA/Util.pm @@ -18,7 +18,9 @@ use base qw(Exporter); log_in logout file_bug_in_product + create_bug go_to_bug + go_to_home go_to_admin edit_product add_product @@ -36,6 +38,7 @@ use base qw(Exporter); use constant WAIT_TIME => 60000; use constant CONF_FILE => "../config/selenium_test.conf"; use constant CHROME_MODE => 1; +use constant NDASH => chr(0x2013); ##################### # Utility Functions # @@ -132,6 +135,12 @@ sub get_rpc_clients { # Helpers for Selenium Scripts # ################################ +sub go_to_home { + my ($sel, $config) = @_; + $sel->open_ok("/$config->{bugzilla_installation}/", undef, "Go to the home page"); + $sel->title_is("Bugzilla Main Page"); +} + # Go to the home/login page and log in. sub log_in { my ($sel, $config, $user) = @_; @@ -178,6 +187,17 @@ sub file_bug_in_product { $sel->title_is("Enter Bug: $product", "Display form to enter bug data"); } +sub create_bug { + my ($sel, $bug_summary) = @_; + my $ndash = NDASH; + + $sel->click_ok('commit'); + $sel->wait_for_page_to_load_ok(WAIT_TIME); + my $bug_id = $sel->get_value('//input[@name="id" and @type="hidden"]'); + $sel->title_is("Bug $bug_id Submitted $ndash $bug_summary", "Bug $bug_id created with summary '$bug_summary'"); + return $bug_id; +} + # Go to show_bug.cgi. sub go_to_bug { my ($sel, $bug_id) = @_; diff --git a/t/test_search.t b/t/test_search.t index f510fb4..5978cd2 100644 --- a/t/test_search.t +++ b/t/test_search.t @@ -11,16 +11,54 @@ my ($sel, $config) = get_selenium(); # First, a very trivial search, which returns no result. -$sel->open_ok("/$config->{bugzilla_installation}/query.cgi?format=advanced"); -$sel->title_is("Search for bugs", "Display the Advanced Query Form"); -$sel->type_ok("short_desc", "justdave", "Type a non-existent string in the bug summary field"); -$sel->click_ok("Search", undef, "Start search"); +go_to_home($sel, $config); +open_advanced_search_page($sel); +$sel->type_ok("short_desc", "ois£jdfm#sd%fasd!fm", "Type a non-existent string in the bug summary field"); +$sel->click_ok("Search"); $sel->wait_for_page_to_load(WAIT_TIME); -$sel->title_is("Bug List", "Display buglist"); -$sel->is_text_present_ok("Zarro Boogs found.", undef, "0 bugs found"); +$sel->title_is("Bug List"); +$sel->is_text_present_ok("Zarro Boogs found"); # Display all available columns. Look for all bugs assigned to a user who doesn't exist. $sel->open_ok("/$config->{bugzilla_installation}/buglist.cgi?quicksearch=%40xx45ft&columnlist=all"); -$sel->title_is("Bug List", "Display buglist"); -$sel->is_text_present_ok("Zarro Boogs found.", undef, "0 bugs found"); +$sel->title_is("Bug List"); +$sel->is_text_present_ok("Zarro Boogs found"); + +# Now some real tests. + +log_in($sel, $config, 'canconfirm'); +file_bug_in_product($sel, "TestProduct"); +my $bug_summary = "Update this summary with this bug ID"; +$sel->type_ok("short_desc", $bug_summary); +$sel->type_ok("comment", "I'm supposed to appear in the coming buglist."); +my $bug1_id = create_bug($sel, $bug_summary); +$sel->click_ok("editme_action"); +$bug_summary .= ": my ID is $bug1_id"; +$sel->type_ok("short_desc", $bug_summary); +$sel->type_ok("comment", "Updating bug summary...."); +$sel->click_ok("commit"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("Bug $bug1_id processed"); + +# Test pronoun substitution. + +open_advanced_search_page($sel); +$sel->remove_all_selections("bug_status"); +$sel->remove_all_selections("resolution"); +$sel->type_ok("short_desc", "my ID is $bug1_id"); +$sel->select_ok("field0-0-0", "label=Commenter"); +$sel->select_ok("type0-0-0", "label=is equal to"); +$sel->type_ok("value0-0-0", "%user%"); +$sel->click_ok("cmd-add0-1-0"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("Search for bugs"); +$sel->select_ok("field0-1-0", "label=Comment"); +$sel->select_ok("type0-1-0", "label=contains the string"); +$sel->type_ok("value0-1-0", "coming buglist"); +$sel->click_ok("Search"); +$sel->wait_for_page_to_load_ok(WAIT_TIME); +$sel->title_is("Bug List"); +$sel->is_text_present_ok("One bug found"); +$sel->is_text_present_ok("Update this summary with this bug ID: my ID is $bug1_id"); +logout($sel); From 425d847e26cf7061e7ce51bc83c0c750bc32da9f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Buclin?= Date: Sat, 24 Sep 2011 02:02:08 +0200 Subject: [PATCH 07/34] Forgot to reset the strict_isolation parameter https://bugzilla.mozilla.org/show_bug.cgi?id=309681 --- t/test_strict_isolation.t | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/t/test_strict_isolation.t b/t/test_strict_isolation.t index 2652ed9..ded8fdd 100644 --- a/t/test_strict_isolation.t +++ b/t/test_strict_isolation.t @@ -119,6 +119,10 @@ $sel->wait_for_page_to_load_ok(WAIT_TIME); $sel->title_is("Invalid User Group"); $sel->is_text_present_ok("User '$no_privs_user' is not able to edit the 'Another Product' Product"); +# Reset parameters back to defaults. + +set_parameters($sel, { "Group Security" => {"strict_isolation-off" => undef} }); + go_to_admin($sel); $sel->click_ok("link=Users"); $sel->wait_for_page_to_load_ok(WAIT_TIME); From ec628bd5ff7d2e8c0ef3e2d345ffdb05bf015156 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Buclin?= Date: Sat, 24 Sep 2011 02:13:38 +0200 Subject: [PATCH 08/34] Bug.create() must throw an error if an invalid group is passed https://bugzilla.mozilla.org/show_bug.cgi?id=653341 --- t/webservice_bug_create.t | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/t/webservice_bug_create.t b/t/webservice_bug_create.t index bac0c2f..657024d 100644 --- a/t/webservice_bug_create.t +++ b/t/webservice_bug_create.t @@ -6,7 +6,7 @@ use strict; use warnings; use lib qw(lib); use Storable qw(dclone); -use Test::More tests => 287; +use Test::More tests => 293; use QA::Util; use QA::Tests qw(create_bug_fields PRIVATE_BUG_USER); @@ -139,14 +139,12 @@ my $fields = { }, }, -# XXX This should fail explicitly but does not yet--it currently -# fails silently. -# groups => { -# non_existent => { -# faultstring => 'some error should be here', -# value => [random_string(20)], -# }, -# }, + groups => { + non_existent => { + faultstring => 'either this group does not exist, or you are not allowed to restrict bugs to this group', + value => [random_string(20)], + }, + }, comment_is_private => { invalid => { faultstring => 'you are not allowed to.+comments.+private', From 589f5440e24874965c21a0bd1657f394d93dc9d3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Buclin?= Date: Sat, 3 Dec 2011 00:48:43 +0100 Subject: [PATCH 09/34] Remove useless escaping characters --- t/test_custom_fields.t | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/t/test_custom_fields.t b/t/test_custom_fields.t index 7d84fa9..f5f9851 100644 --- a/t/test_custom_fields.t +++ b/t/test_custom_fields.t @@ -38,7 +38,7 @@ $sel->value_is("obsolete", "off"); $sel->click_ok("create"); $sel->wait_for_page_to_load_ok(WAIT_TIME); $sel->title_is("Custom Field Created"); -$sel->is_text_present_ok("The new custom field \'cf_qa_freetext_$bug1_id\' has been successfully created."); +$sel->is_text_present_ok("The new custom field 'cf_qa_freetext_$bug1_id' has been successfully created."); $sel->click_ok("link=Add a new custom field"); $sel->wait_for_page_to_load_ok(WAIT_TIME); @@ -55,20 +55,20 @@ $sel->value_is("obsolete", "off"); $sel->click_ok("create"); $sel->wait_for_page_to_load_ok(WAIT_TIME); $sel->title_is("Custom Field Created"); -$sel->is_text_present_ok("The new custom field \'cf_qa_list_$bug1_id\' has been successfully created."); +$sel->is_text_present_ok("The new custom field 'cf_qa_list_$bug1_id' has been successfully created."); # Add values to the custom fields. $sel->click_ok("link=cf_qa_list_$bug1_id"); $sel->wait_for_page_to_load_ok(WAIT_TIME); -$sel->title_is("Edit the Custom Field \'cf_qa_list_$bug1_id\' (List$bug1_id)"); +$sel->title_is("Edit the Custom Field 'cf_qa_list_$bug1_id' (List$bug1_id)"); $sel->click_ok("link=Edit legal values for this field"); $sel->wait_for_page_to_load_ok(WAIT_TIME); -$sel->title_is("Select value for the \'List$bug1_id\' (cf_qa_list_$bug1_id) field"); +$sel->title_is("Select value for the 'List$bug1_id' (cf_qa_list_$bug1_id) field"); $sel->click_ok("link=Add"); $sel->wait_for_page_to_load_ok(WAIT_TIME); -$sel->title_is("Add Value for the \'List$bug1_id\' (cf_qa_list_$bug1_id) field"); +$sel->title_is("Add Value for the 'List$bug1_id' (cf_qa_list_$bug1_id) field"); $sel->type_ok("value", "have fun?"); $sel->type_ok("sortkey", "805"); $sel->click_ok("create"); @@ -78,7 +78,7 @@ $sel->is_text_present_ok("The value have fun? has been added as a valid choice f $sel->click_ok("link=Add"); $sel->wait_for_page_to_load_ok(WAIT_TIME); -$sel->title_is("Add Value for the \'List$bug1_id\' (cf_qa_list_$bug1_id) field"); +$sel->title_is("Add Value for the 'List$bug1_id' (cf_qa_list_$bug1_id) field"); $sel->type_ok("value", "storage"); $sel->type_ok("sortkey", "49"); $sel->click_ok("create"); @@ -243,10 +243,10 @@ $sel->wait_for_page_to_load_ok(WAIT_TIME); $sel->title_is("Edit values for which field?"); $sel->click_ok("link=List$bug1_id"); $sel->wait_for_page_to_load_ok(WAIT_TIME); -$sel->title_is("Select value for the \'List$bug1_id\' (cf_qa_list_$bug1_id) field"); +$sel->title_is("Select value for the 'List$bug1_id' (cf_qa_list_$bug1_id) field"); $sel->click_ok("//a[contains(\@href, 'editvalues.cgi?action=del&field=cf_qa_list_$bug1_id&value=have%20fun%3F')]"); $sel->wait_for_page_to_load_ok(WAIT_TIME); -$sel->title_is("Delete Value \'have fun?\' from the \'List$bug1_id\' (cf_qa_list_$bug1_id) field"); +$sel->title_is("Delete Value 'have fun?' from the 'List$bug1_id' (cf_qa_list_$bug1_id) field"); $sel->is_text_present_ok("Do you really want to delete this value?"); $sel->click_ok("delete"); $sel->wait_for_page_to_load_ok(WAIT_TIME); @@ -256,7 +256,7 @@ $sel->title_is("Field Value Deleted"); $sel->click_ok("//a[contains(\@href, 'editvalues.cgi?action=del&field=cf_qa_list_$bug1_id&value=storage')]"); $sel->wait_for_page_to_load_ok(WAIT_TIME); -$sel->title_is("Delete Value \'storage\' from the \'List$bug1_id\' (cf_qa_list_$bug1_id) field"); +$sel->title_is("Delete Value 'storage' from the 'List$bug1_id' (cf_qa_list_$bug1_id) field"); $sel->is_text_present_ok("There is 1 bug with this field value"); # Mark the