 Edouard Vanbelle
|
ac42a6d3cc
|
test(api): check right management for folder creation and folder move + check also webdsav MKCOL protection
│ Steps 1-6 │ Setup: admin's resources + create bob + bob's home folder │
│ Step 7 │ REST: bob can't create a folder inside admin's home → 404 │
│ Step 8 │ REST: bob can't create inside admin's private folder → 404 │
│ Step 9 │ REST: parent_id: null auto-resolves to bob's home (documents the convenience) │
│ Step 10 │ REST: positive control — bob creates in his own home → 201 │
│ Step 12 │ REST: bob can't move his file into admin's folder → 404 │
│ Step 13 │ REST: bob moves file to root (null) → 200 (legitimate root state) │
│ Step 14 │ REST: bob can't read admin's file → 404 │
│ Step 15 │ REST: admin's tree integrity preserved │
│ Step 16 │ WebDAV: path-prefix isolation rewrites cross-user paths into caller's tree │
│ Step 17 │ WebDAV: positive control MKCOL in bob's own tree → 201 │
│ Step 18 │ WebDAV: bob's home contains the rewritten "My Folder - admin" sub-folder, proving the isolation rerouted the attack │
│ Step 19 │ WebDAV: admin's tree never sees bob's WebDAV traffic │
|
2026-05-20 13:04:15 +02:00 |
|
|
Edouard Vanbelle
|
78cb37b311
|
feat: check thumbnail cleanup on files deletion + correct ref counter
|
2026-05-13 15:55:38 +02:00 |
|
|
Edouard Vanbelle
|
07d1f18bf4
|
test API thumbnail fix on updates
|
2026-05-13 10:17:47 +02:00 |
|
|
Edouard Vanbelle
|
e953236589
|
test(api): add functional test on copy_folder
|
2026-05-12 00:28:42 +02:00 |
|
|
Edouard Vanbelle
|
a0aa9c5cd1
|
ci: trigger test on /tests change
|
2026-05-11 20:00:22 +02:00 |
|
|
Edouard Vanbelle
|
5df4075f7f
|
test(api): add API test coverage on files, folders, favorites, recent, trash
|
2026-05-11 19:31:12 +02:00 |
|
|
Edouard Vanbelle
|
d8625b9f39
|
ci: merge end-to-end workflow into ci, permits to reduce amount of built
|
2026-05-11 12:10:15 +02:00 |
|
|
Edouard Vanbelle
|
cc14ec53ee
|
ci(api-tests): add API test to CI
|
2026-05-11 10:53:59 +02:00 |
|
|
Edouard Vanbelle
|
8ab537797a
|
test(api): add API test on contacts
next will be to add CI on it
|
2026-05-11 00:53:29 +02:00 |
|