-
Type:
Bug
-
Status: Closed (View Workflow)
-
Priority:
Critical
-
Resolution: Fixed
-
Affects Version/s: 0.20 Larks
-
Fix Version/s: 0.20 Larks
-
Labels:None
Even though in the profile you can choose from dropdown list, user can send a POST request with any number and server will accept this as valid.
Expected Behavior: server doesn't accept any value that is not in the suggested dropdown list.
Test Enviroment
javatalks.net 0.20 Larks, Firefox 16.0.2, Chrome 23.0
Test Scenario
1. Sign in
2. Try to change page size to different numbers(14,15,16,24,25,26,49,50,51,100...) in profile via POST request in Fiddler.
AR=ER=post request with 15,25,50 receive a status 302 Found, other numbers: 14,16,24,26,49,51,100 receive a status 200 Ok
Regression tests:
changing post to get in signing in, editing password; changing get to post in viewing profile, main page; changing password and user's name to different impossible values via post request in signing in, editing password
Test results:
It can be closed
Alyona did you check the profile on UI after post request has been send?
Yes, I did. For 15,25,50 page size changed in UI, for other numbers nothing happened.
Alyona you are awesome! Thank you very much!!
Also please test the possibility to change get to post and vice versa