README follow errors and admin CSRF requirements differ from shipped handlers #18
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Found during independent exact-head review of BUG-34 / PR 17 at
50d72f27e9. Confidence: high, code and passing HTTP integration tests agree.README.md:14 says wrong deletion tokens return 403, but src/app.rs:537-546 falls back to a valid X-Breadbug-Install and tests/follow.rs:245-284 explicitly expects 201 for a wrong token plus a valid install. Qualify 403 as a wrong well-formed deletion token without a valid install fallback, and document the fallback and 400 for missing/malformed credentials.
README.md:27 says every POST requires the page CSRF token. src/admin.rs:149-179 exempts bearer-authenticated actions and login_submit:204-230 does not require CSRF. Specify authenticated cookie-session action POSTs, not all POSTs. tests/admin.rs cookie_login_requires_csrf_for_actions and bearer actions pass.
Repair these descriptions in the existing PR 17 fix/readme-touchups, not a duplicate PR.
Verified fixed at
eeaa2cfc9d(PR 17 second commit). Follow error wording and CSRF scope now match shipped handlers exactly; see criterion mapping in PR issuecomment-4580. Both BUG-34 and BUG-35 pass; merging PR 17 next. Not moving to done (coordinator verifies integration).Integration result: repair merged with PR 17 at
8669888d64. Awaiting verification by coordinator; leaving card in place, not moving to done.Defects verified fixed in merged PR17 at
8669888(same verification as BUG-34).