public function change_album_no_csrf_fails_test()
{
$controller = new Albums_Controller();
$root = ORM::factory("item", 1);
$this->_album = album::create($root, "test", "test", "test");
$_POST["name"] = "new name";
$_POST["title"] = "new title";
$_POST["description"] = "new description";
access::allow(group::everybody(), "edit", $root);
try {
$controller->_update($this->_album);
$this->assert_true(false, "This should fail");
} catch (Exception $e) {
// pass
}
}
public function change_album_no_csrf_fails_test()
{
$controller = new Albums_Controller();
$album = test::random_album();
$_POST["name"] = "new name";
$_POST["title"] = "new title";
$_POST["description"] = "new description";
access::allow(identity::everybody(), "edit", item::root());
try {
$controller->update($album->id);
$this->assert_true(false, "This should fail");
} catch (Exception $e) {
// pass
$this->assert_same("@todo FORBIDDEN", $e->getMessage());
}
}
