chore(test): cleanup NewRequest which no longer supply CSRF values (#10119)

Followup to https://codeberg.org/forgejo/forgejo/pulls/9830, which greatly simplified the tests that previously had to supply a csrf token in values map, but left behind the more complex funcs with empty maps.

Also fixed a few typos which popped up in the diff.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/10119
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: 0ko <0ko@noreply.codeberg.org>
Co-committed-by: 0ko <0ko@noreply.codeberg.org>
This commit is contained in:
0ko 2025-11-14 23:21:10 +01:00 committed by Gusted
parent 8f28cdefe0
commit a51a8d5701
24 changed files with 45 additions and 45 deletions

View file

@ -136,7 +136,7 @@ func webAuth(authMethod auth_service.Method) func(*context.Context) {
// verifyAuthWithOptions checks authentication according to options
func verifyAuthWithOptions(options *common.VerifyOptions) func(ctx *context.Context) {
crossOrginProtection := http.NewCrossOriginProtection()
crossOriginProtection := http.NewCrossOriginProtection()
return func(ctx *context.Context) {
// Check prohibit login users.
if ctx.IsSigned {
@ -195,7 +195,7 @@ func verifyAuthWithOptions(options *common.VerifyOptions) func(ctx *context.Cont
}
if !options.SignOutRequired && !options.DisableCSRF {
if err := crossOrginProtection.Check(ctx.Req); err != nil {
if err := crossOriginProtection.Check(ctx.Req); err != nil {
http.Error(ctx.Resp, err.Error(), http.StatusForbidden)
return
}

View file

@ -67,7 +67,7 @@ func TestActionsVariablesModification(t *testing.T) {
assert.Equal(t, "success%3DThe%2Bvariable%2Bhas%2Bbeen%2Bedited.", flashCookie.Value)
}
req = NewRequestWithValues(t, "POST", baseURL+fmt.Sprintf("/%d/delete", id), map[string]string{})
req = NewRequest(t, "POST", baseURL+fmt.Sprintf("/%d/delete", id))
if fail {
resp := sess.MakeRequest(t, req, http.StatusBadRequest)
var error errorJSON

View file

@ -80,7 +80,7 @@ func TestAdminViewUser(t *testing.T) {
func TestAdminEditUser(t *testing.T) {
defer tests.PrepareTestEnv(t)()
testSuccessfullEdit(t, user_model.User{ID: 2, Name: "newusername", LoginName: "otherlogin", Email: "new@e-mail.gitea"})
testSuccessfulEdit(t, user_model.User{ID: 2, Name: "newusername", LoginName: "otherlogin", Email: "new@e-mail.gitea"})
}
func TestAdminEditUserHideEmail(t *testing.T) {
@ -128,7 +128,7 @@ func TestAdminEditUserHideEmail(t *testing.T) {
htmlDoc.AssertElement(t, `input[name="hide_email"][checked]`, true)
}
func testSuccessfullEdit(t *testing.T, formData user_model.User) {
func testSuccessfulEdit(t *testing.T, formData user_model.User) {
makeRequest(t, formData, http.StatusSeeOther)
}

View file

@ -399,7 +399,7 @@ func TestRebuildCargo(t *testing.T) {
t.Run("No index", func(t *testing.T) {
defer tests.PrintCurrentTest(t)()
req := NewRequestWithValues(t, "POST", "/user/settings/packages/cargo/rebuild", map[string]string{})
req := NewRequest(t, "POST", "/user/settings/packages/cargo/rebuild")
session.MakeRequest(t, req, http.StatusSeeOther)
flashCookie := session.GetCookie(app_context.CookieNameFlash)
@ -418,7 +418,7 @@ func TestRebuildCargo(t *testing.T) {
htmlDoc.AssertElement(t, `form[action="/user/settings/packages/cargo/rebuild"]`, false)
htmlDoc.AssertElement(t, `form[action="/user/settings/packages/cargo/initialize"]`, true)
req = NewRequestWithValues(t, "POST", "/user/settings/packages/cargo/initialize", map[string]string{})
req = NewRequest(t, "POST", "/user/settings/packages/cargo/initialize")
session.MakeRequest(t, req, http.StatusSeeOther)
unittest.AssertExistsIf(t, true, &repo_model.Repository{OwnerID: user.ID, Name: cargo_service.IndexRepositoryName})
@ -433,7 +433,7 @@ func TestRebuildCargo(t *testing.T) {
t.Run("With index", func(t *testing.T) {
defer tests.PrintCurrentTest(t)()
req := NewRequestWithValues(t, "POST", "/user/settings/packages/cargo/rebuild", map[string]string{})
req := NewRequest(t, "POST", "/user/settings/packages/cargo/rebuild")
session.MakeRequest(t, req, http.StatusSeeOther)
flashCookie := session.GetCookie(app_context.CookieNameFlash)

View file

@ -31,7 +31,7 @@ func TestBranchActions(t *testing.T) {
t.Run("Delete branch", func(t *testing.T) {
link := fmt.Sprintf("/%s/branches/delete?name=%s", repo1.FullName(), branch3.Name)
req := NewRequestWithValues(t, "POST", link, map[string]string{})
req := NewRequest(t, "POST", link)
session.MakeRequest(t, req, http.StatusOK)
flashCookie := session.GetCookie(app_context.CookieNameFlash)
assert.NotNil(t, flashCookie)
@ -42,7 +42,7 @@ func TestBranchActions(t *testing.T) {
t.Run("Restore branch", func(t *testing.T) {
link := fmt.Sprintf("/%s/branches/restore?branch_id=%d&name=%s", repo1.FullName(), branch3.ID, branch3.Name)
req := NewRequestWithValues(t, "POST", link, map[string]string{})
req := NewRequest(t, "POST", link)
session.MakeRequest(t, req, http.StatusOK)
flashCookie := session.GetCookie(app_context.CookieNameFlash)
assert.NotNil(t, flashCookie)

View file

@ -37,7 +37,7 @@ func TestUserDeleteAccount(t *testing.T) {
session := loginUser(t, "user8")
urlStr := fmt.Sprintf("/user/settings/account/delete?password=%s", userPassword)
req := NewRequestWithValues(t, "POST", urlStr, map[string]string{})
req := NewRequest(t, "POST", urlStr)
session.MakeRequest(t, req, http.StatusSeeOther)
assertUserDeleted(t, 8, false)
@ -49,7 +49,7 @@ func TestUserDeleteAccountStillOwnRepos(t *testing.T) {
session := loginUser(t, "user2")
urlStr := fmt.Sprintf("/user/settings/account/delete?password=%s", userPassword)
req := NewRequestWithValues(t, "POST", urlStr, map[string]string{})
req := NewRequest(t, "POST", urlStr)
session.MakeRequest(t, req, http.StatusSeeOther)
// user should not have been deleted, because the user still owns repos

View file

@ -43,7 +43,7 @@ func TestExploreRepos(t *testing.T) {
// Star the repo
session := loginUser(t, "user5")
session.MakeRequest(t, NewRequestWithValues(t, "POST", fmt.Sprintf("/%s/action/star", repo), map[string]string{}), http.StatusOK)
session.MakeRequest(t, NewRequest(t, "POST", fmt.Sprintf("/%s/action/star", repo)), http.StatusOK)
// Stars counter should have incremented
testExploreStarForkCounters(t, repo, "1 star", "0 forks")

View file

@ -680,7 +680,7 @@ func doPushCreate(ctx APITestContext, u *url.URL, objectFormat git.ObjectFormat)
func doBranchDelete(ctx APITestContext, owner, repo, branch string) func(*testing.T) {
return func(t *testing.T) {
req := NewRequestWithValues(t, "POST", fmt.Sprintf("/%s/%s/branches/delete?name=%s", url.PathEscape(owner), url.PathEscape(repo), url.QueryEscape(branch)), map[string]string{})
req := NewRequest(t, "POST", fmt.Sprintf("/%s/%s/branches/delete?name=%s", url.PathEscape(owner), url.PathEscape(repo), url.QueryEscape(branch)))
ctx.Session.MakeRequest(t, req, http.StatusOK)
}
}

View file

@ -578,9 +578,9 @@ func TestIssueCommentDelete(t *testing.T) {
assert.Equal(t, comment1, comment.Content)
// Using the ID of a comment that does not belong to the repository must fail
req := NewRequestWithValues(t, "POST", fmt.Sprintf("/%s/%s/comments/%d/delete", "user5", "repo4", commentID), map[string]string{})
req := NewRequest(t, "POST", fmt.Sprintf("/%s/%s/comments/%d/delete", "user5", "repo4", commentID))
session.MakeRequest(t, req, http.StatusNotFound)
req = NewRequestWithValues(t, "POST", fmt.Sprintf("/%s/%s/comments/%d/delete", "user2", "repo1", commentID), map[string]string{})
req = NewRequest(t, "POST", fmt.Sprintf("/%s/%s/comments/%d/delete", "user2", "repo1", commentID))
session.MakeRequest(t, req, http.StatusOK)
unittest.AssertNotExistsBean(t, &issues_model.Comment{ID: commentID})
}
@ -1028,7 +1028,7 @@ func TestIssuePinMove(t *testing.T) {
issueURL, issue := testIssueWithBean(t, "user2", 1, "Title", "Content")
assert.Equal(t, 0, issue.PinOrder)
req := NewRequestWithValues(t, "POST", fmt.Sprintf("%s/pin", issueURL), map[string]string{})
req := NewRequest(t, "POST", fmt.Sprintf("%s/pin", issueURL))
session.MakeRequest(t, req, http.StatusOK)
issue = unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: issue.ID})

View file

@ -28,7 +28,7 @@ func TestIssueAddTimeManually(t *testing.T) {
t.Run("No time", func(t *testing.T) {
defer tests.PrintCurrentTest(t)()
session.MakeRequest(t, NewRequestWithValues(t, "POST", issue2.Link()+"/times/add", map[string]string{}), http.StatusSeeOther)
session.MakeRequest(t, NewRequest(t, "POST", issue2.Link()+"/times/add"), http.StatusSeeOther)
flashCookie := session.GetCookie(forgejo_context.CookieNameFlash)
assert.NotNil(t, flashCookie)

View file

@ -59,7 +59,7 @@ func TestOrgTeamEmailInvite(t *testing.T) {
// join the team
inviteURL := fmt.Sprintf("/org/invite/%s", invites[0].Token)
req = NewRequestWithValues(t, "POST", inviteURL, map[string]string{})
req = NewRequest(t, "POST", inviteURL)
resp = session.MakeRequest(t, req, http.StatusSeeOther)
req = NewRequest(t, "GET", test.RedirectURL(resp))
session.MakeRequest(t, req, http.StatusOK)
@ -130,7 +130,7 @@ func TestOrgTeamEmailInviteRedirectsExistingUser(t *testing.T) {
session.jar.SetCookies(baseURL, cr.Cookies())
// make the request
req = NewRequestWithValues(t, "POST", test.RedirectURL(resp), map[string]string{})
req = NewRequest(t, "POST", test.RedirectURL(resp))
resp = session.MakeRequest(t, req, http.StatusSeeOther)
req = NewRequest(t, "GET", test.RedirectURL(resp))
session.MakeRequest(t, req, http.StatusOK)
@ -198,7 +198,7 @@ func TestOrgTeamEmailInviteRedirectsNewUser(t *testing.T) {
session.jar.SetCookies(baseURL, cr.Cookies())
// make the redirected request
req = NewRequestWithValues(t, "POST", test.RedirectURL(resp), map[string]string{})
req = NewRequest(t, "POST", test.RedirectURL(resp))
resp = session.MakeRequest(t, req, http.StatusSeeOther)
req = NewRequest(t, "GET", test.RedirectURL(resp))
session.MakeRequest(t, req, http.StatusOK)

View file

@ -322,7 +322,7 @@ func TestTeamWithoutPermissionToShowTable(t *testing.T) {
})
session.MakeRequest(t, req, http.StatusSeeOther)
req = NewRequestWithValues(t, "GET", fmt.Sprintf("/org/%s/teams/%s/edit", org.Name, team.Name), map[string]string{})
req = NewRequest(t, "GET", fmt.Sprintf("/org/%s/teams/%s/edit", org.Name, team.Name))
resp := session.MakeRequest(t, req, http.StatusOK)
htmlDoc := NewHTMLParser(t, resp.Body)

View file

@ -97,7 +97,7 @@ func testPullCleanUp(t *testing.T, session *TestSession, user, repo, pullnum str
htmlDoc := NewHTMLParser(t, resp.Body)
link, exists := htmlDoc.doc.Find(".timeline-item .delete-button").Attr("data-url")
assert.True(t, exists, "The template has changed, can not find delete button url")
req = NewRequestWithValues(t, "POST", link, map[string]string{})
req = NewRequest(t, "POST", link)
resp = session.MakeRequest(t, req, http.StatusOK)
return resp
@ -1084,7 +1084,7 @@ func TestPullAutoMergeAfterCommitStatusSucceedAndApprovalForAgitFlow(t *testing.
approveSession := loginUser(t, "user1")
testSubmitReview(t, approveSession, "user2", "repo1", strconv.Itoa(int(pr.Index)), sha, "approve", http.StatusOK)
// realod pr again
// reload pr again
pr = unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{ID: pr.ID})
assert.True(t, pr.HasMerged)
assert.NotEmpty(t, pr.MergedCommitID)

View file

@ -146,7 +146,7 @@ func TestPullrequestReopen(t *testing.T) {
t.Helper()
link := fmt.Sprintf("/%s/branches", repoName)
req := NewRequestWithValues(t, "POST", fmt.Sprintf("%s/restore?branch_id=%d&name=%s", link, branchID, branchName), map[string]string{})
req := NewRequest(t, "POST", fmt.Sprintf("%s/restore?branch_id=%d&name=%s", link, branchID, branchName))
session.MakeRequest(t, req, http.StatusOK)
flashCookie := session.GetCookie(app_context.CookieNameFlash)
@ -158,7 +158,7 @@ func TestPullrequestReopen(t *testing.T) {
t.Helper()
link := fmt.Sprintf("/%s/branches", repoName)
req := NewRequestWithValues(t, "POST", fmt.Sprintf("%s/delete?name=%s", link, branchName), map[string]string{})
req := NewRequest(t, "POST", fmt.Sprintf("%s/delete?name=%s", link, branchName))
session.MakeRequest(t, req, http.StatusOK)
flashCookie := session.GetCookie(app_context.CookieNameFlash)

View file

@ -591,7 +591,7 @@ func TestPullReviewInArchivedRepo(t *testing.T) {
})
}
func testNofiticationCount(t *testing.T, session *TestSession, expectedSubmitStatus int) *httptest.ResponseRecorder {
func testNotificationCount(t *testing.T, session *TestSession, expectedSubmitStatus int) *httptest.ResponseRecorder {
options := map[string]string{}
req := NewRequestWithValues(t, "GET", "/", options)
@ -631,7 +631,7 @@ func testIssueClose(t *testing.T, session *TestSession, owner, repo, issueNumber
}
func getUserNotificationCount(t *testing.T, session *TestSession) string {
resp := testNofiticationCount(t, session, http.StatusOK)
resp := testNotificationCount(t, session, http.StatusOK)
doc := NewHTMLParser(t, resp.Body)
return doc.Find(`.notification_count`).Text()
}

View file

@ -114,19 +114,19 @@ func TestDeleteRelease(t *testing.T) {
session5 := loginUser(t, "user5")
otherRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{OwnerName: "user5", LowerName: "repo4"})
req := NewRequestWithValues(t, "POST", fmt.Sprintf("%s/releases/delete?id=%d", otherRepo.Link(), release.ID), map[string]string{})
req := NewRequest(t, "POST", fmt.Sprintf("%s/releases/delete?id=%d", otherRepo.Link(), release.ID))
session5.MakeRequest(t, req, http.StatusNotFound)
session := loginUser(t, "user2")
req = NewRequestWithValues(t, "POST", fmt.Sprintf("%s/releases/delete?id=%d", repo.Link(), release.ID), map[string]string{})
req = NewRequest(t, "POST", fmt.Sprintf("%s/releases/delete?id=%d", repo.Link(), release.ID))
session.MakeRequest(t, req, http.StatusOK)
release = unittest.AssertExistsAndLoadBean(t, &repo_model.Release{ID: release.ID})
if assert.True(t, release.IsTag) {
req = NewRequestWithValues(t, "POST", fmt.Sprintf("%s/tags/delete?id=%d", otherRepo.Link(), release.ID), map[string]string{})
req = NewRequest(t, "POST", fmt.Sprintf("%s/tags/delete?id=%d", otherRepo.Link(), release.ID))
session5.MakeRequest(t, req, http.StatusNotFound)
req = NewRequestWithValues(t, "POST", fmt.Sprintf("%s/tags/delete?id=%d", repo.Link(), release.ID), map[string]string{})
req = NewRequest(t, "POST", fmt.Sprintf("%s/tags/delete?id=%d", repo.Link(), release.ID))
session.MakeRequest(t, req, http.StatusOK)
unittest.AssertNotExistsBean(t, &repo_model.Release{ID: release.ID})

View file

@ -361,7 +361,7 @@ func TestRepositoryFlagsUI(t *testing.T) {
flagged := flaggedRepo.IsFlagged(db.DefaultContext)
assert.True(t, flagged)
req := NewRequestWithValues(t, "POST", flaggedRepoManageURL, map[string]string{})
req := NewRequest(t, "POST", flaggedRepoManageURL)
session.MakeRequest(t, req, http.StatusSeeOther)
flagged = flaggedRepo.IsFlagged(db.DefaultContext)

View file

@ -65,7 +65,7 @@ func TestRepoMigrateWithCredentials(t *testing.T) {
})
t.Run("Dangerous credential", func(t *testing.T) {
// Temporaily change the password
// Temporarily change the password
dangerousPassword := "some`echo foo`thing"
require.NoError(t, user2.SetPassword(dangerousPassword))
require.NoError(t, user_model.UpdateUserCols(t.Context(), user2, "passwd", "passwd_hash_algo", "salt"))

View file

@ -34,11 +34,11 @@ func TestRepoPaginations(t *testing.T) {
t.Run("Stars", func(t *testing.T) {
// Add stars to user2/repo1.
session := loginUser(t, "user2")
req := NewRequestWithValues(t, "POST", "/user2/repo1/action/star", map[string]string{})
req := NewRequest(t, "POST", "/user2/repo1/action/star")
session.MakeRequest(t, req, http.StatusOK)
session = loginUser(t, "user1")
req = NewRequestWithValues(t, "POST", "/user2/repo1/action/star", map[string]string{})
req = NewRequest(t, "POST", "/user2/repo1/action/star")
session.MakeRequest(t, req, http.StatusOK)
testRepoPagination(t, session, "user2/repo1", "stars", &setting.MaxUserCardsPerPage)
@ -46,7 +46,7 @@ func TestRepoPaginations(t *testing.T) {
t.Run("Watcher", func(t *testing.T) {
// user2/repo2 is watched by its creator user2. Watch it by user1 to make it watched by 2 users.
session := loginUser(t, "user1")
req := NewRequestWithValues(t, "POST", "/user2/repo2/action/watch", map[string]string{})
req := NewRequest(t, "POST", "/user2/repo2/action/watch")
session.MakeRequest(t, req, http.StatusOK)
testRepoPagination(t, session, "user2/repo2", "watchers", &setting.MaxUserCardsPerPage)

View file

@ -54,7 +54,7 @@ func TestActivityPubRepoFollowing(t *testing.T) {
defer tests.PrintCurrentTest(t)()
repoLink := fmt.Sprintf("/%s", repo.FullName())
link := fmt.Sprintf("%s/action/star", repoLink)
req := NewRequestWithValues(t, "POST", link, map[string]string{})
req := NewRequest(t, "POST", link)
session.MakeRequest(t, req, http.StatusOK)

View file

@ -26,7 +26,7 @@ func testRepoStarringOrWatching(t *testing.T, action, listURI string, expectEmpt
session := loginUser(t, "user5")
// Star/Watch the repo as user5
req := NewRequestWithValues(t, "POST", fmt.Sprintf("/user2/repo1/action/%s", action), map[string]string{})
req := NewRequest(t, "POST", fmt.Sprintf("/user2/repo1/action/%s", action))
session.MakeRequest(t, req, http.StatusOK)
// Load the repo home as user5
@ -63,7 +63,7 @@ func testRepoStarringOrWatching(t *testing.T, action, listURI string, expectEmpt
}
// Unstar/unwatch the repo as user5
req = NewRequestWithValues(t, "POST", fmt.Sprintf("/user2/repo1/action/%s", oppositeAction), map[string]string{})
req = NewRequest(t, "POST", fmt.Sprintf("/user2/repo1/action/%s", oppositeAction))
session.MakeRequest(t, req, http.StatusOK)
// Load the repo home as user5

View file

@ -175,7 +175,7 @@ func TestSettingSecurityTwoFactorRequirement(t *testing.T) {
htmlDoc.AssertElement(t, "#disable-form", showUnroll)
htmlDoc.AssertSelection(t, htmlDoc.FindByText("p", locale.TrString("settings.twofa_unroll_unavailable")), showReroll && !showUnroll)
req := NewRequestWithValues(t, "POST", "user/settings/security/two_factor/disable", map[string]string{})
req := NewRequest(t, "POST", "user/settings/security/two_factor/disable")
if user.MustHaveTwoFactor() {
session.MakeRequest(t, req, http.StatusNotFound)
} else {

View file

@ -43,7 +43,7 @@ func testViewTimetrackingControls(t *testing.T, session *TestSession, user, repo
htmlDoc.AssertElement(t, ".timetrack .issue-start-time", canTrackTime)
htmlDoc.AssertElement(t, ".timetrack .issue-add-time", canTrackTime)
req = NewRequestWithValues(t, "POST", path.Join(user, repo, "issues", issue, "times", "stopwatch", "toggle"), map[string]string{})
req = NewRequest(t, "POST", path.Join(user, repo, "issues", issue, "times", "stopwatch", "toggle"))
if canTrackTime {
resp = session.MakeRequest(t, req, http.StatusSeeOther)
@ -57,7 +57,7 @@ func testViewTimetrackingControls(t *testing.T, session *TestSession, user, repo
htmlDoc.AssertElement(t, ".timetrack .issue-stop-time", true)
htmlDoc.AssertElement(t, ".timetrack .issue-cancel-time", true)
req = NewRequestWithValues(t, "POST", path.Join(user, repo, "issues", issue, "times", "stopwatch", "toggle"), map[string]string{})
req = NewRequest(t, "POST", path.Join(user, repo, "issues", issue, "times", "stopwatch", "toggle"))
resp = session.MakeRequest(t, req, http.StatusSeeOther)
req = NewRequest(t, "GET", test.RedirectURL(resp))

View file

@ -741,7 +741,7 @@ func TestUserTOTPMail(t *testing.T) {
unittest.AssertSuccessfulInsert(t, &auth_model.TwoFactor{UID: user.ID})
unittest.AssertSuccessfulInsert(t, &auth_model.WebAuthnCredential{UserID: user.ID})
req := NewRequestWithValues(t, "POST", "/user/settings/security/two_factor/disable", map[string]string{})
req := NewRequest(t, "POST", "/user/settings/security/two_factor/disable")
session.MakeRequest(t, req, http.StatusSeeOther)
assert.True(t, called)
@ -918,7 +918,7 @@ func TestUserTOTPDisable(t *testing.T) {
htmlDoc := NewHTMLParser(t, resp.Body)
htmlDoc.AssertElement(t, "#disable-form", disableAllowed)
req := NewRequestWithValues(t, "POST", "user/settings/security/two_factor/disable", map[string]string{})
req := NewRequest(t, "POST", "user/settings/security/two_factor/disable")
if status == http.StatusSeeOther {
resp := session.MakeRequest(t, req, http.StatusSeeOther)
assert.Equal(t, "/user/settings/security", resp.Header().Get("Location"))