Fix unauthenticated access to table styles. Closes #43.
Re-introduces use of the redis "privacy" hash key as an additional security measure for requests that do not involve PostgreSQL access. Accessing private table styles is tested with this commit. Accessing private table metadata or infowindow is _not_ tested, but should also be fixed now.
This commit is contained in:
@@ -44,7 +44,7 @@ suite('server', function() {
|
||||
}, function() { done(); });
|
||||
});
|
||||
|
||||
/* FAILS !
|
||||
// See https://github.com/Vizzuality/Windshaft-cartodb/issues/43
|
||||
test("get'ing style of private table should fail when unauthenticated",
|
||||
function(done) {
|
||||
assert.response(server, {
|
||||
@@ -58,7 +58,6 @@ suite('server', function() {
|
||||
done();
|
||||
});
|
||||
});
|
||||
*/
|
||||
|
||||
test("get'ing style of private table should succeed when authenticated",
|
||||
function(done) {
|
||||
|
||||
Reference in New Issue
Block a user