Upgraded drupal core with security updates

[yaffs-website] / web / core / modules / views / src / Tests / ViewAjaxTest.php

diff --git a/web/core/modules/views/src/Tests/ViewAjaxTest.php b/web/core/modules/views/src/Tests/ViewAjaxTest.php
index b8b2730e6edcbd1da848ffd01d46239e9924408e..5a966a8f76ba29845e6dff2c9ecb027eda9401e5 100644 (file)
--- a/web/core/modules/views/src/Tests/ViewAjaxTest.php
+++ b/web/core/modules/views/src/Tests/ViewAjaxTest.php
@@ -17,7 +17,7 @@ class ViewAjaxTest extends ViewTestBase {
    *
    * @var array
    */
-  public static $testViews = ['test_ajax_view'];
+  public static $testViews = ['test_ajax_view', 'test_view'];
 
   protected function setUp() {
     parent::setUp();
@@ -61,4 +61,14 @@ class ViewAjaxTest extends ViewTestBase {
     $this->assertEqual(count($result), 2, 'Ensure that two items are rendered in the HTML.');
   }
 
+  /**
+   * Ensures that non-ajax view cannot be accessed via an ajax HTTP request.
+   */
+  public function testNonAjaxViewViaAjax() {
+    $this->drupalPost('views/ajax', '', ['view_name' => 'test_ajax_view', 'view_display_id' => 'default'], ['query' => [MainContentViewSubscriber::WRAPPER_FORMAT => 'drupal_ajax']]);
+    $this->assertResponse(200);
+    $this->drupalPost('views/ajax', '', ['view_name' => 'test_view', 'view_display_id' => 'default'], ['query' => [MainContentViewSubscriber::WRAPPER_FORMAT => 'drupal_ajax']]);
+    $this->assertResponse(403);
+  }
+
 }