55 lines
2.0 KiB
Python
55 lines
2.0 KiB
Python
 
|
"""Templates: saved replies from the compose window's More menu."""
|
||
|
|
|
||
|
|
from __future__ import annotations
|
||
|
|
|
||
|
|
from tests.api.conftest import HDR, UserCtx
|
||
|
|
|
||
|
|
|
||
|
|
async def test_save_list_replace_delete(user_ctx: UserCtx) -> None:
|
||
|
|
c = user_ctx.client
|
||
|
|
assert (await c.get("/api/templates")).json() == []
|
||
|
|
|
||
|
|
resp = await c.post(
|
||
|
|
"/api/templates",
|
||
|
|
json={"name": " Thanks ", "subject": "Re: offer", "body_html": "<p>Thank <b>you</b></p>"},
|
||
|
|
headers=HDR,
|
||
|
|
)
|
||
|
|
assert resp.status_code == 200, resp.text
|
||
|
|
first = resp.json()
|
||
|
|
assert first["name"] == "Thanks" and first["subject"] == "Re: offer"
|
||
|
|
|
||
|
|
# Same name, any case: replaces rather than adding a second one.
|
||
|
|
resp = await c.post(
|
||
|
|
"/api/templates", json={"name": "thanks", "body_html": "<p>Cheers</p>"}, headers=HDR
|
||
|
|
)
|
||
|
|
assert resp.json()["id"] == first["id"]
|
||
|
|
await c.post("/api/templates", json={"name": "Apology", "body_html": "x"}, headers=HDR)
|
||
|
|
listed = (await c.get("/api/templates")).json()
|
||
|
|
assert [t["name"] for t in listed] == ["Apology", "thanks"]
|
||
|
|
assert listed[1]["body_html"] == "<p>Cheers</p>"
|
||
|
|
|
||
|
|
assert (await c.delete(f"/api/templates/{first['id']}", headers=HDR)).status_code == 200
|
||
|
|
assert [t["name"] for t in (await c.get("/api/templates")).json()] == ["Apology"]
|
||
|
|
|
||
|
|
|
||
|
|
async def test_template_html_is_cleaned(user_ctx: UserCtx) -> None:
|
||
|
|
resp = await user_ctx.client.post(
|
||
|
|
"/api/templates",
|
||
|
|
json={
|
||
|
|
"name": "x",
|
||
|
|
"body_html": '<p onclick="evil()">Hi<script>alert(1)</script>'
|
||
|
|
'<img src="x" onerror="evil()"><a href="javascript:evil()">l</a></p>',
|
||
|
|
},
|
||
|
|
headers=HDR,
|
||
|
|
)
|
||
|
|
html = resp.json()["body_html"]
|
||
|
|
assert "script" not in html and "onclick" not in html and "onerror" not in html
|
||
|
|
assert "javascript:" not in html and "Hi" in html
|
||
|
|
|
||
|
|
|
||
|
|
async def test_template_needs_a_name(user_ctx: UserCtx) -> None:
|
||
|
|
resp = await user_ctx.client.post(
|
||
|
|
"/api/templates", json={"name": " ", "body_html": "x"}, headers=HDR
|
||
|
|
)
|
||
|
|
assert resp.status_code == 400
|