Live-тесты: успех не-sudo с выданным правом - #712
Open
Ibochkarev wants to merge 2 commits into
Open
Conversation
Deny-only and sudo paths cannot detect an environment that rejects all non-sudo users. Grant via isolated group/policy and revoke without emptying policy data (MODX treats empty data as allow-all).
Ibochkarev
added
priority: medium
ROLE_MEMBER is not defined on 3.1.2-pl; the live ACL grant helper must not depend on that constant.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Описание
После #699 live-сьют проверяет отказ без групп и успех для sudo. Среды, которые режут всех не-sudo, этот набор не ловит.
Добавлен
GrantsContextPermissionsвtests/Modx/Support/: изолированная группа + policy на текущем контексте (webв testbench) и тестSettings\Status\Createсmssetting_save. В том же тестеrevokeContextPermissions()убирает право. Пустойpolicy.dataв MODX = allow-all, поэтому revoke пишет sentinelloadбез целевого ключа.Тип изменений
Связанные Issues
Closes #710
Связано: #696, #699
Как это было протестировано?
cd core/components/minishop3 php -l tests/Modx/Support/GrantsContextPermissions.php php -l tests/Modx/Support/ExtraTestCase.php php -l tests/Modx/StatusCreateProcessorTest.phpExit codes:
0.Локально
composer test:modx -- --filter StatusCreateProcessorTestне прогонялся (нет доступа к MySQL testbench). Ожидается зелёный jobmodx-testbenchв CI.composer ci:php/composer test,npm run lint:ci,composer stan/ GitHub Actions CI)Конфигурация тестирования:
test/issue-710-granted-permission-accessphp -l)Скриншоты (если применимо)
Чеклист
composer stan/ CI jobPHPStan)npm run lint:ciдля Vue)Дополнительные заметки
web), не наmgr— иначеhasPermission()в testbench не увидит грант.modxkit/testbenchне делался (out of scope).