blob: a3dbc6418c7984187371193b9c48ebff1d606534 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
|
import pytest
from django.test.client import Client
from activities.models import Post
from users.models import Identity
@pytest.mark.django_db
def test_post_delete_security(client_with_identity: Client, other_identity: Identity):
"""
Tests that you can't delete other users' posts with URL fiddling
"""
other_post = Post.objects.create(
content="<p>OTHER POST!</p>",
author=other_identity,
local=True,
visibility=Post.Visibilities.public,
)
response = client_with_identity.get(other_post.urls.action_delete)
assert response.status_code == 403
|
