Commit 4582a47c authored by Łukasz Nowak's avatar Łukasz Nowak

Check that acquisition is not possible.

This test will allow to track progress on "securing" API -- that it will
disallow to access objects outside of its scope.
parent ef96c19c
......@@ -1185,6 +1185,21 @@ class TestGET_discovery(VifibSlaposRestAPIV1Mixin):
'discovery',
])
def test_noAcquisition(self):
# check the test
portal_id = self.portal.getId()
self.logout()
self.assertEqual(portal_id, self.portal.getId())
self.login()
# prove that even if anyone has access to portal root it is impossible
# to fetch it via API
self.connection.request(method='GET',
url='/'.join([self.api_path, self.portal.getId(), 'getId'])
)
self.prepareResponse()
self.assertResponseCode(404)
self.assertBasicResponse()
def test(self):
self.connection.request(method='GET',
url=self.api_path)
......
52
\ No newline at end of file
53
\ No newline at end of file
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment