X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/c7399ec7afdf0cfdd0f3177f410f102083a26e15..e4fca76d5db9bd844530454894d07ddc729b4a9a:/apps/workbench/test/controllers/projects_controller_test.rb?ds=inline
diff --git a/apps/workbench/test/controllers/projects_controller_test.rb b/apps/workbench/test/controllers/projects_controller_test.rb
index 61c882d9f9..3522745fe4 100644
--- a/apps/workbench/test/controllers/projects_controller_test.rb
+++ b/apps/workbench/test/controllers/projects_controller_test.rb
@@ -32,7 +32,7 @@ class ProjectsControllerTest < ActionController::TestCase
id: readonly_project_uuid
}, session_for(which_user)
buttons = css_select('[data-method=post]').select do |el|
- el.attributes['data-remote-href'].match /project.*owner_uuid.*#{readonly_project_uuid}/
+ el.attributes['data-remote-href'].value.match /project.*owner_uuid.*#{readonly_project_uuid}/
end
if should_show
assert_not_empty(buttons, "did not offer to create a subproject")
@@ -335,10 +335,20 @@ class ProjectsControllerTest < ActionController::TestCase
project = api_fixture('groups')['aproject']
use_token :active
found = Group.find(project['uuid'])
- found.description = 'Textile description with link to home page take me home.'
+ found.description = 'Textile description with link to home page take me home.'
found.save!
get(:show, {id: project['uuid']}, session_for(:active))
- assert_includes @response.body, 'Textile description with link to home page take me home.'
+ assert_includes @response.body, 'Textile description with link to home page take me home.'
+ end
+
+ test "find a project and edit description to unsafe html description" do
+ project = api_fixture('groups')['aproject']
+ use_token :active
+ found = Group.find(project['uuid'])
+ found.description = 'Textile description with unsafe script tag .'
+ found.save!
+ get(:show, {id: project['uuid']}, session_for(:active))
+ assert_includes @response.body, 'Textile description with unsafe script tag alert("Hello there").'
end
test "find a project and edit description to textile description with link to object" do