fc2c5fe414
Recent refactorings have resulted in the header being added twice, this makes browsers ignore the header which removes any security gains. This changeset adds the header only once and adds integration tests ensuring the correct header in future. https://github.com/owncloud/core/issues/22577
70 lines
2.6 KiB
Gherkin
70 lines
2.6 KiB
Gherkin
Feature: sharing
|
|
Background:
|
|
Given using api version "1"
|
|
|
|
Scenario: moving a file old way
|
|
Given using dav path "remote.php/webdav"
|
|
And As an "admin"
|
|
And user "user0" exists
|
|
When User "user0" moves file "/textfile0.txt" to "/FOLDER/textfile0.txt"
|
|
Then the HTTP status code should be "201"
|
|
|
|
Scenario: download a file with range
|
|
Given using dav path "remote.php/webdav"
|
|
And As an "admin"
|
|
When Downloading file "/welcome.txt" with range "bytes=51-77"
|
|
Then Downloaded content should be "example file for developers"
|
|
|
|
Scenario: Upload forbidden if quota is 0
|
|
Given using dav path "remote.php/webdav"
|
|
And As an "admin"
|
|
And user "user0" exists
|
|
And user "user0" has a quota of "0"
|
|
When User "user0" uploads file "data/textfile.txt" to "/asdf.txt"
|
|
Then the HTTP status code should be "507"
|
|
|
|
Scenario: download a public shared file with range
|
|
Given user "user0" exists
|
|
And As an "user0"
|
|
When creating a share with
|
|
| path | welcome.txt |
|
|
| shareType | 3 |
|
|
And Downloading last public shared file with range "bytes=51-77"
|
|
Then Downloaded content should be "example file for developers"
|
|
|
|
Scenario: Downloading a file on the old endpoint should serve security headers
|
|
Given using dav path "remote.php/webdav"
|
|
And As an "admin"
|
|
When Downloading file "/welcome.txt"
|
|
Then The following headers should be set
|
|
|Content-Disposition|attachment|
|
|
|Content-Security-Policy|default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *|
|
|
|X-Content-Type-Options |nosniff|
|
|
|X-Download-Options|noopen|
|
|
|X-Frame-Options|Sameorigin|
|
|
|X-Permitted-Cross-Domain-Policies|none|
|
|
|X-Robots-Tag|none|
|
|
|X-XSS-Protection|1; mode=block|
|
|
And Downloaded content should start with "Welcome to your ownCloud account!"
|
|
|
|
Scenario: Downloading a file on the new endpoint should serve security headers
|
|
Given using dav path "remote.php/dav/files/admin/"
|
|
And As an "admin"
|
|
When Downloading file "/welcome.txt"
|
|
Then The following headers should be set
|
|
|Content-Disposition|attachment|
|
|
|Content-Security-Policy|default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *|
|
|
|X-Content-Type-Options |nosniff|
|
|
|X-Download-Options|noopen|
|
|
|X-Frame-Options|Sameorigin|
|
|
|X-Permitted-Cross-Domain-Policies|none|
|
|
|X-Robots-Tag|none|
|
|
|X-XSS-Protection|1; mode=block|
|
|
And Downloaded content should start with "Welcome to your ownCloud account!"
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|