29 lines
1021 B
PHP
29 lines
1021 B
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Models\Artwork;
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
it('rejects raw html when updating artwork descriptions from the dashboard editor', function (): void {
|
|
$user = User::factory()->create();
|
|
$artwork = Artwork::factory()->for($user)->create([
|
|
'title' => 'Dashboard Artwork',
|
|
'slug' => 'dashboard-artwork',
|
|
'description' => 'Original description',
|
|
]);
|
|
|
|
$this->from(route('dashboard.artworks.edit', ['id' => $artwork->id]))
|
|
->actingAs($user)
|
|
->put(route('dashboard.artworks.update', ['id' => $artwork->id]), [
|
|
'title' => 'Dashboard Artwork',
|
|
'description' => '<img src="https://spam.example/test.jpg" alt="">',
|
|
])
|
|
->assertRedirect(route('dashboard.artworks.edit', ['id' => $artwork->id]))
|
|
->assertSessionHasErrors(['description']);
|
|
|
|
expect($artwork->fresh()->description)->toBe('Original description');
|
|
}); |