Merge pull request #40406 from owncloud/test-indirect-resource-existe…

…nce-leaks [full-ci] Test indirect resource existence leaks
owncloud · Oct 14, 2022 · aa770a5 · aa770a5
2 parents 6a3c89e + 408fb23
commit aa770a5
Show file tree

Hide file tree

Showing 4 changed files with 50 additions and 34 deletions.
diff --git a/changelog/unreleased/40406 b/changelog/unreleased/40406
@@ -0,0 +1,5 @@
+Change: Test indirect resource existence
+
+We now expect a not found error instead of permission denied error for some trash interactions.
+
+https://github.com/owncloud/core/pull/40406
diff --git a/tests/acceptance/features/apiTrashbin/trashbinDelete.feature b/tests/acceptance/features/apiTrashbin/trashbinDelete.feature
@@ -93,19 +93,20 @@ Feature: files and folders can be deleted from the trashbin
     And user "Alice" has deleted file "/PARENT/parent.txt"
     And user "Alice" has deleted file "/PARENT/CHILD/child.txt"
     When user "Brian" tries to delete the file with original path "textfile1.txt" from the trashbin of user "Alice" using the trashbin API
-    Then the HTTP status code should be "401"
+    Then the HTTP status code should be "<status-code>"
     And as "Alice" the file with original path "/textfile1.txt" should exist in the trashbin
     And as "Alice" the file with original path "/textfile0.txt" should exist in the trashbin
     And as "Alice" the file with original path "/PARENT/parent.txt" should exist in the trashbin
     And as "Alice" the file with original path "/PARENT/CHILD/child.txt" should exist in the trashbin
+    @skipOnOcis
     Examples:
-      | dav-path |
-      | new      |
-
+      | dav-path | status-code |
+      | new      | 401         |
     @skipOnOcV10 @personalSpace
     Examples:
-      | dav-path |
-      | spaces   |
+      | dav-path | status-code |
+      | new      | 404         |
+      | spaces   | 404         |
 
   Scenario Outline: User tries to delete trashbin file using invalid password
     Given using <dav-path> DAV path

diff --git a/tests/acceptance/features/apiTrashbin/trashbinFilesFolders.feature b/tests/acceptance/features/apiTrashbin/trashbinFilesFolders.feature
@@ -185,18 +185,19 @@ Feature: files and folders exist in the trashbin after being deleted
     And user "Brian" has been created with default attributes and without skeleton files
     And user "testtrashbin100" has deleted file "/textfile1.txt"
     When user "Brian" tries to list the trashbin content for user "testtrashbin100"
-    Then the HTTP status code should be "401"
+    Then the HTTP status code should be "<status-code>"
     And the last webdav response should not contain the following elements
       | path          | user            |
       | textfile1.txt | testtrashbin100 |
+    @skipOnOcis
     Examples:
-      | dav-path |
-      | new      |
-
+      | dav-path | status-code |
+      | new      | 401         |
     @skipOnOcV10 @personalSpace
     Examples:
-      | dav-path |
-      | spaces   |
+      | dav-path | status-code |
+      | new      | 404         |
+      | spaces   | 404         |
 
   @issue-ocis-3561 @smokeTest @skipOnLDAP @skip_on_objectstore @skipOnOcV10.3
   Scenario Outline: Listing other user's trashbin is prohibited with multiple files on trashbin
@@ -208,19 +209,20 @@ Feature: files and folders exist in the trashbin after being deleted
     And user "testtrashbin101" has deleted file "/textfile0.txt"
     And user "testtrashbin101" has deleted file "/textfile2.txt"
     When user "Brian" tries to list the trashbin content for user "testtrashbin101"
-    Then the HTTP status code should be "401"
+    Then the HTTP status code should be "<status-code>"
     And the last webdav response should not contain the following elements
       | path          | user            |
       | textfile0.txt | testtrashbin101 |
       | textfile2.txt | testtrashbin101 |
+    @skipOnOcis
     Examples:
-      | dav-path |
-      | new      |
-
+      | dav-path | status-code |
+      | new      | 401         |
     @skipOnOcV10 @personalSpace
     Examples:
-      | dav-path |
-      | spaces   |
+      | dav-path | status-code |
+      | new      | 404         |
+      | spaces   | 404         |
 
   @issue-ocis-3561 @skipOnLDAP @skip_on_objectstore @skipOnOcV10.3
   Scenario Outline: Listing other user's trashbin is prohibited for newly recreated user with same name
@@ -238,36 +240,38 @@ Feature: files and folders exist in the trashbin after being deleted
     And user "testtrashbin102" has uploaded file "filesForUpload/textfile.txt" to "/textfile3.txt"
     And user "testtrashbin102" has deleted file "/textfile3.txt"
     When user "Brian" tries to list the trashbin content for user "testtrashbin102"
-    Then the HTTP status code should be "401"
+    Then the HTTP status code should be "<status-code>"
     And the last webdav response should not contain the following elements
       | path          | user            |
       | textfile0.txt | testtrashbin102 |
       | textfile2.txt | testtrashbin102 |
       | textfile3.txt | testtrashbin102 |
+    @skipOnOcis
     Examples:
-      | dav-path |
-      | new      |
-
+      | dav-path | status-code |
+      | new      | 401         |
     @skipOnOcV10 @personalSpace
     Examples:
-      | dav-path |
-      | spaces   |
+      | dav-path | status-code |
+      | new      | 404         |
+      | spaces   | 404         |
 
   @issue-ocis-3561 @skipOnLDAP @skip_on_objectstore
   Scenario Outline: Listing other user's empty unused trashbin is prohibited
     Given using <dav-path> DAV path
     And user "testtrashbinempty" has been created with default attributes and without skeleton files
     And user "testtrashbinempty" has uploaded file "filesForUpload/textfile.txt" to "/textfile1.txt"
     When user "Alice" tries to list the trashbin content for user "testtrashbinempty"
-    Then the HTTP status code should be "401"
+    Then the HTTP status code should be "<status-code>"
+    @skipOnOcis
     Examples:
-      | dav-path |
-      | new      |
-
+      | dav-path | status-code |
+      | new      | 401         |
     @skipOnOcV10 @personalSpace
     Examples:
-      | dav-path |
-      | spaces   |
+      | dav-path | status-code |
+      | new      | 404         |
+      | spaces   | 404         |
 
   @issue-ocis-3561 @skipOnLDAP @skip_on_objectstore
   Scenario Outline: Listing non-existent user's trashbin is prohibited

diff --git a/tests/acceptance/features/apiTrashbinRestore/trashbinRestore.feature b/tests/acceptance/features/apiTrashbinRestore/trashbinRestore.feature
@@ -195,14 +195,20 @@ Feature: Restore deleted files/folders
     And user "Brian" has been created with default attributes and without skeleton files
     And user "Alice" has deleted file "/textfile0.txt"
     When user "Brian" tries to restore the file with original path "/textfile0.txt" from the trashbin of user "Alice" using the trashbin API
-    Then the HTTP status code should be "401"
+    Then the HTTP status code should be "<status-code>"
     And as "Alice" the folder with original path "/textfile0.txt" should exist in the trashbin
     And user "Alice" should not see the following elements
       | /textfile0.txt |
+    @skipOnOcis
     Examples:
-      | dav-path |
-      | old      |
-      | new      |
+      | dav-path | status-code |
+      | old      | 401         |
+      | new      | 401         |
+    @skipOnOcV10
+    Examples:
+      | dav-path | status-code |
+      | old      | 404         |
+      | new      | 404         |
 
   @smokeTest
   Scenario Outline: A deleted file cannot be restored with invalid password