Redmine

    def test_index_should_not_leak_identifier_to_non_admin

      # Project 5 is private; user 4 is not a member, so Project.visible would

      # exclude it. Without authorization the action would render and the

      # project's identifier ("private-child") would surface in link hrefs.

      private_project = Project.find(5)

      assert_equal false, private_project.is_public

      assert_not User.find(4).member_of?(private_project)

      @request.session[:user_id] = 4

      get(:index, :params => {:ids => [5]})

      assert_response :forbidden

      assert_not_includes @response.body, private_project.identifier

    end

    def test_index_should_not_expose_existence_oracle

      # Existing private id and missing id must both return 403 — same

      # status, no enumeration oracle.

      @request.session[:user_id] = 4

      get(:index, :params => {:ids => [5]})

      assert_response :forbidden

      get(:index, :params => {:ids => [999_999]})

      assert_response :forbidden

    end

    def test_index_should_not_leak_archived_state

      # The response must not distinguish active ("Archive" button) from

      # archived ("Unarchive" button) projects the user cannot see.

      Project.find(5).archive

      @request.session[:user_id] = 4

      get(:index, :params => {:ids => [5]})

      assert_response :forbidden

      assert_select 'a.icon-unlock', :text => /Unarchive/i, :count => 0

      assert_select 'a.icon-lock',   :text => /Archive/i,   :count => 0

    end

    def test_index_should_not_leak_activity_names_from_invisible_project

      # time_entry 5 belongs to project 5 (private). User 4 is not a member;

      # the menu must not render and no activity names from the private

      # project may leak via the response body.

      entry = TimeEntry.find(5)

      assert_equal 5, entry.project_id

      assert_not entry.visible?(User.find(4))

      @request.session[:user_id] = 4

      get(:index, :params => {:ids => [5]})

      assert_response :not_found

      Project.find(5).activities.each do |activity|

        assert_not_includes @response.body, activity.name

      end

    end

    def test_index_should_not_leak_lock_state_to_non_admin

      # User 5 (Dave Lopper2) is locked in fixtures. The rendered menu must

      # not show an "Unlock" link to non-admins, revealing lock status.

      assert User.find(5).locked?

      @request.session[:user_id] = 4

      get :index, :params => {:ids => [5]}

      assert_response :forbidden

      assert_select 'a.icon-unlock', :text => /Unlock/i,   :count => 0

      assert_select 'a',             :text => /Activate/i, :count => 0

    end

    def test_index_should_not_leak_registered_state

      # Registered (not-yet-activated) users must not surface an "Activate"

      # link, revealing their pending-activation state.

      User.find(5).update_columns(:status => User::STATUS_REGISTERED)

      @request.session[:user_id] = 4

      get :index, :params => {:ids => [5]}

      assert_response :forbidden

      assert_select 'a', :text => /Activate/i, :count => 0

    end

    def test_index_should_not_expose_existence_oracle

      @request.session[:user_id] = 4

      get :index, :params => {:ids => [8]}

      assert_response :forbidden

      get :index, :params => {:ids => [999_999]}

      assert_response :forbidden

    end

    def test_index_should_not_render_admin_links_for_non_admin

      # The menu must not expose /users/:id/edit and DELETE /users/:id for

      # any caller, confirming the target id exists.

      @request.session[:user_id] = 4

      get :index, :params => {:ids => [8]}

      assert_response :forbidden

      assert_select 'a.icon-edit', :count => 0

      assert_select 'a.icon-del',  :count => 0

    end