47 lines
2.5 KiB
Python
47 lines
2.5 KiB
Python
|
"""V8.32 regression: authenticated inline preview stays same-origin and other routes stay denied."""
|
||
|
|
from test_factory_v2 import factory,site
|
||
|
|
|
||
|
|
|
||
|
|
def test_theme_preview_is_frameable_only_on_same_origin(factory):
|
||
|
|
for theme in ('automotive','industrial','corporate','minimal'):
|
||
|
|
for page in ('home','listing','product','article','about','contact'):
|
||
|
|
result=factory.get(f'/api/factory/themes/{theme}/preview',params={'page_type':page})
|
||
|
|
assert result.status_code==200,(theme,page,result.text[:120])
|
||
|
|
assert result.headers['x-frame-options']=='SAMEORIGIN'
|
||
|
|
assert result.headers['content-security-policy']=="frame-ancestors 'self'"
|
||
|
|
assert result.headers['cache-control']=='no-store'
|
||
|
|
assert 'text/html' in result.headers['content-type']
|
||
|
|
assert factory.get('/theme-gallery').headers['x-frame-options']=='DENY'
|
||
|
|
assert factory.get('/operations').headers['x-frame-options']=='DENY'
|
||
|
|
assert factory.get('/api/factory/themes/automotive/preview.css').headers['x-frame-options']=='DENY'
|
||
|
|
|
||
|
|
|
||
|
|
def test_preview_requires_login_and_other_protections_remain(factory):
|
||
|
|
from tests.legacy import LegacyTestClient as Client
|
||
|
|
from app.main import app
|
||
|
|
with Client(app) as unauth:
|
||
|
|
result=unauth.get('/api/factory/themes/automotive/preview')
|
||
|
|
assert result.status_code==401
|
||
|
|
assert factory.get('/api/factory/themes/automotive/preview?page_type=invalid').status_code==400
|
||
|
|
|
||
|
|
|
||
|
|
def test_gallery_and_studio_show_useful_fallback_and_easy_buttons(factory):
|
||
|
|
gallery=factory.get('/theme-gallery').text
|
||
|
|
assert 'previewStatus' in gallery and 'retryPreview' in gallery and 'openPreview' in gallery
|
||
|
|
assert 'requestedTheme' in gallery and 'response.ok' in gallery
|
||
|
|
sid=site(factory)
|
||
|
|
pages=factory.get(f'/api/sites/{sid}/entries').json()
|
||
|
|
entry=pages[0]['id']
|
||
|
|
html=factory.get(f'/editor/{sid}/{entry}').text
|
||
|
|
assert 'studioAdvancedButton' in html
|
||
|
|
assert 'sfNextAction' in html and 'sfCloseInspector' in html
|
||
|
|
assert 'sandbox="allow-scripts"' in html and 'allow-same-origin' not in html
|
||
|
|
js=factory.get('/ui/editor.js').text
|
||
|
|
assert 'toggleAdvanced(){' in js
|
||
|
|
assert "response.ok" in js and 'themePreviewSeq' in js
|
||
|
|
assert '从图片素材库选择' in js and '上传新图片' in js
|
||
|
|
css=factory.get('/ui/editor.css').text
|
||
|
|
assert 'body:not(.sf-advanced-mode) #tabStyle' in css
|
||
|
|
workspace=factory.get('/ui/workspace.js').text
|
||
|
|
assert '预览页面效果' in workspace and '/theme-gallery?theme=' in workspace
|