9d2b1c1848
- acme.deferred fixture plugin over testdata/deferred (test-only), two controllers, recording Form and Relation hooks, two admins - TestRelationChildScope*: every child route answers 404 for another parent, a hidden parent and another admin's pending child, changes nothing; undeclared toolbar buttons 403 before SQL; pivot whitelist - TestProtectedFile*: foreign, pending and public files 404; only jpeg, png, gif and webp inline; nosniff, no-store and sandbox CSP everywhere
21 lines
529 B
YAML
21 lines
529 B
YAML
# The same relations with a reduced toolbar: parts may only be linked and
|
|
# members only unlinked, so every other relation route answers 403.
|
|
members:
|
|
label: Members
|
|
view:
|
|
list:
|
|
columns:
|
|
email:
|
|
label: Email
|
|
toolbarButtons: unlink
|
|
pivot:
|
|
form: $/acme/deferred/models/member/pivot_fields.yaml
|
|
parts:
|
|
label: Parts
|
|
view:
|
|
list:
|
|
columns:
|
|
label:
|
|
label: Label
|
|
toolbarButtons: link
|