golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(16.3-03): expect 32 CSRF-gated admin routes after token API

Browse Source 
Account token create/revoke added two state-changing mounts; update the
Phase 10 CSRF walk count so the release gate inventory stays green.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Jakub Zych
2026-10-11 02:20:55 +02:00
parent 60873a3fea
commit 2030fd881a
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
modules/cabana/phase10_csrf_test.go
View File

@@ -66,14 +66,15 @@ func TestPhase10CSRF(t *testing.T) {
}
})
}
// refresh, logout, account update, avatar upload and remove, markdown preview, settings put, create, bulk-delete, bulk action,
// widget action, toolbar action, update, delete, record action, link,
// unlink, file
// upload, file reorder, file caption, file remove, relation child
// create, update and delete, pivot update, child file upload, reorder,
// caption and remove, plugin field type upload
if unsafe != 30 {
t.Fatalf("walked %d state-changing routes, want 30: %v", unsafe, router.order)
// refresh, logout, account update, avatar upload and remove, account
// token create and revoke, markdown preview, settings put, create,
// bulk-delete, bulk action, widget action, toolbar action, update,
// delete, record action, link, unlink, file upload, file reorder, file
// caption, file remove, relation child create, update and delete, pivot
// update, child file upload, reorder, caption and remove, plugin field
// type upload
if unsafe != 32 {
t.Fatalf("walked %d state-changing routes, want 32: %v", unsafe, router.order)
}
loginHandler := router.handlers[login]