{% for locale, lang_data in available_languages.items()|sort %}
-
- {{ lang_data.name }}
-
+
{% endfor %}
{{ _('Language support is in beta, please help us improve by opening a PR on GitHub with any updates.') }}
diff --git a/changedetectionio/templates/menu.html b/changedetectionio/templates/menu.html
index e199cc6f1..859081c5a 100644
--- a/changedetectionio/templates/menu.html
+++ b/changedetectionio/templates/menu.html
@@ -18,7 +18,10 @@
{%- if current_user.is_authenticated -%}
- {{ _('Log out') }}
+
{%- endif -%}
diff --git a/changedetectionio/tests/proxy_socks5/test_socks5_proxy.py b/changedetectionio/tests/proxy_socks5/test_socks5_proxy.py
index 99b6d54d1..69da88b77 100644
--- a/changedetectionio/tests/proxy_socks5/test_socks5_proxy.py
+++ b/changedetectionio/tests/proxy_socks5/test_socks5_proxy.py
@@ -84,10 +84,12 @@ def test_socks5(client, live_server, measure_memory_usage, datastore_path):
# PROXY CHECKER WIDGET CHECK - this needs more checking
uuid = next(iter(live_server.app.config['DATASTORE'].data['watching']))
- res = client.get(
+ # POST only - it kicks off real fetches through every configured proxy
+ res = client.post(
url_for("check_proxies.start_check", uuid=uuid),
follow_redirects=True
)
+ assert res.status_code == 200
# It's probably already finished super fast :(
#assert b"RUNNING" in res.data
diff --git a/changedetectionio/tests/test_access_control.py b/changedetectionio/tests/test_access_control.py
index 771a9df8b..2ab8c76e0 100644
--- a/changedetectionio/tests/test_access_control.py
+++ b/changedetectionio/tests/test_access_control.py
@@ -125,7 +125,7 @@ def test_check_access_control(app, client, live_server, measure_memory_usage, da
follow_redirects=True
)
- res = c.get(url_for("logout"),
+ res = c.post(url_for("logout"),
follow_redirects=True)
assert b"Login" in res.data
diff --git a/changedetectionio/tests/test_add_watch_ui_browser.py b/changedetectionio/tests/test_add_watch_ui_browser.py
index 56c9f0ff0..d49d99483 100644
--- a/changedetectionio/tests/test_add_watch_ui_browser.py
+++ b/changedetectionio/tests/test_add_watch_ui_browser.py
@@ -79,26 +79,41 @@ def test_snapshot_refuses_browser_that_cannot_preview(client, live_server, measu
from changedetectionio.blueprint.add_watch_ui import browser_config
monkeypatch.setattr(browser_config, 'is_visual_capable', lambda name, datastore: False)
+ snapshot_url = url_for('add_watch_ui.add_watch_ui_snapshot')
+
# Nothing capable, and no explicit browser asked for -> nothing to preview with
- res = client.get(url_for('add_watch_ui.add_watch_ui_snapshot', url='https://example.com'))
+ res = client.post(snapshot_url, data={'url': 'https://example.com'})
assert res.status_code == 400
assert b'No interactive browser' in res.data
# Explicitly asking for a browser that can't preview is refused just the same
- res = client.get(url_for('add_watch_ui.add_watch_ui_snapshot', url='https://example.com',
- fetch_backend='html_requests'))
+ res = client.post(snapshot_url, data={'url': 'https://example.com',
+ 'fetch_backend': 'html_requests'})
assert res.status_code == 400
# A made-up name never resolves to a capable fetcher either (real capability lookup here)
monkeypatch.undo()
- res = client.get(url_for('add_watch_ui.add_watch_ui_snapshot', url='https://example.com',
- fetch_backend='../../etc/passwd'))
+ res = client.post(snapshot_url, data={'url': 'https://example.com',
+ 'fetch_backend': '../../etc/passwd'})
assert res.status_code == 400
- res = client.get(url_for('add_watch_ui.add_watch_ui_snapshot', url='https://example.com',
- fetch_backend='os'))
+ res = client.post(snapshot_url, data={'url': 'https://example.com',
+ 'fetch_backend': 'os'})
assert res.status_code == 400
+def test_snapshot_is_post_only(client, live_server, measure_memory_usage, datastore_path):
+ """A GET must not reach the endpoint at all.
+
+ /snapshot drives a real server-side browser fetch and hands the rendered result back in
+ the response (GHSA-56fq-63vj-9992). As a GET that is reachable by anything that can make
+ the operator's browser issue a request - an ![]()
/