public function change_photo_test()
{
$controller = new Photos_Controller();
$root = ORM::factory("item", 1);
$photo = photo::create($root, MODPATH . "gallery/tests/test.jpg", "test.jpeg", "test", "test", identity::active_user()->id, "slug");
$orig_name = $photo->name;
$_POST["filename"] = "test.jpeg";
$_POST["name"] = "new name";
$_POST["title"] = "new title";
$_POST["description"] = "new description";
$_POST["slug"] = "new-slug";
$_POST["csrf"] = access::csrf_token();
access::allow(identity::everybody(), "edit", $root);
ob_start();
$controller->update($photo->id);
$photo->reload();
$results = ob_get_contents();
ob_end_clean();
$this->assert_equal(json_encode(array("result" => "success", "location" => "HTTP_REFERER")), $results);
$this->assert_equal("new-slug", $photo->slug);
$this->assert_equal("new title", $photo->title);
$this->assert_equal("new description", $photo->description);
// We don't change the name, yet.
$this->assert_equal($orig_name, $photo->name);
}
public function change_photo_no_csrf_fails_test()
{
$controller = new Photos_Controller();
$photo = test::random_photo();
$_POST["name"] = "new name.jpg";
$_POST["title"] = "new title";
$_POST["description"] = "new description";
$_POST["slug"] = "new slug";
access::allow(identity::everybody(), "edit", item::root());
try {
$controller->update($photo);
$this->assert_true(false, "This should fail");
} catch (Exception $e) {
// pass
$this->assert_same("@todo FORBIDDEN", $e->getMessage());
}
}