X-Git-Url: http://git.freeside.biz/gitweb/?a=blobdiff_plain;f=rt%2Ft%2Fweb%2Fpath-traversal.t;h=8207265ef8741141ce94da8fb1d4eec387d7cba2;hb=e131b1f71f08b69abb832c1687d1f29682d171f8;hp=01302e672b2846dbb3129a81f99929278d9ab85d;hpb=d05d7346bb2387fd9d0354923d577275c5c7f019;p=freeside.git

diff --git a/rt/t/web/path-traversal.t b/rt/t/web/path-traversal.t
index 01302e672..8207265ef 100644
--- a/rt/t/web/path-traversal.t
+++ b/rt/t/web/path-traversal.t
@@ -8,35 +8,30 @@ ok($agent->login);
 
 $agent->get("$baseurl/NoAuth/../Elements/HeaderJavascript");
 is($agent->status, 400);
-$agent->warning_like(qr/Invalid request.*aborting/,);
+$agent->warning_like(qr/Invalid request.*aborting/);
 
 $agent->get("$baseurl/NoAuth/../%45lements/HeaderJavascript");
 is($agent->status, 400);
-$agent->warning_like(qr/Invalid request.*aborting/,);
+$agent->warning_like(qr/Invalid request.*aborting/);
 
 $agent->get("$baseurl/NoAuth/%2E%2E/Elements/HeaderJavascript");
 is($agent->status, 400);
-$agent->warning_like(qr/Invalid request.*aborting/,);
+$agent->warning_like(qr/Invalid request.*aborting/);
 
 $agent->get("$baseurl/NoAuth/../../../etc/RT_Config.pm");
 is($agent->status, 400);
-SKIP: {
-    skip "Apache rejects busting up above / for us", 2 if $ENV{RT_TEST_WEB_HANDLER} =~ /^apache/;
-    $agent->warning_like(qr/Invalid request.*aborting/,);
-};
+$agent->warning_like(qr/Invalid request.*aborting/) unless $ENV{RT_TEST_WEB_HANDLER} =~ /^apache/;
 
-$agent->get("$baseurl/NoAuth/css/web2/images/../../../../../../etc/RT_Config.pm");
-is($agent->status, 400);
-SKIP: {
-    skip "Apache rejects busting up above / for us", 2 if $ENV{RT_TEST_WEB_HANDLER} =~ /^apache/;
-    $agent->warning_like(qr/Invalid request.*aborting/,);
-};
+$agent->get("$baseurl/static/css/web2/images/../../../../../../etc/RT_Config.pm");
+# Apache hardcodes a 400m but the static handler returns a 403 for traversal too high
+is($agent->status, $ENV{RT_TEST_WEB_HANDLER} =~ /^apache/ ? 400 : 403);
 
 # Do not reject a simple /. in the URL, for downloading uploaded
 # dotfiles, for example.
 $agent->get("$baseurl/Ticket/Attachment/28/9/.bashrc");
 is($agent->status, 200); # Even for a file not found, we return 200
-$agent->content_contains("Bad attachment id");
+$agent->next_warning_like(qr/could not be loaded/, "couldn't loaded warning");
+$agent->content_like(qr/Attachment \S+ could not be loaded/);
 
 # do not reject these URLs, even though they contain /. outside the path
 $agent->get("$baseurl/index.html?ignored=%2F%2E");