25 lines
763 B
PHP
25 lines
763 B
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Models\Artwork;
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
it('rejects raw html when updating artwork descriptions from studio', function (): void {
|
|
$user = User::factory()->create();
|
|
$artwork = Artwork::factory()->for($user)->create([
|
|
'title' => 'Studio Artwork',
|
|
'slug' => 'studio-artwork',
|
|
'description' => 'Original description',
|
|
]);
|
|
|
|
$this->actingAs($user)
|
|
->putJson(route('api.studio.artworks.update', ['id' => $artwork->id]), [
|
|
'description' => '<img src="https://spam.example/test.jpg" alt="">',
|
|
])
|
|
->assertStatus(422)
|
|
->assertJsonValidationErrors(['description']);
|
|
}); |