_post = $_POST; $this->_photo = null; } public function teardown() { $_POST = $this->_post; if ($this->_photo) { $this->_photo->delete(); } } public function change_photo_test() { $controller = new Photos_Controller(); $root = ORM::factory("item", 1); $this->_photo = photo::create( $root, MODPATH . "gallery/tests/test.jpg", "test.jpeg", "test", "test"); $orig_name = $this->_photo->name; $_POST["filename"] = "test.jpeg"; $_POST["name"] = "new name"; $_POST["title"] = "new title"; $_POST["description"] = "new description"; $_POST["csrf"] = access::csrf_token(); access::allow(group::everybody(), "edit", $root); ob_start(); $controller->_update($this->_photo); $results = ob_get_contents(); ob_end_clean(); $this->assert_equal( json_encode(array("result" => "success")), $results); $this->assert_equal("new title", $this->_photo->title); $this->assert_equal("new description", $this->_photo->description); // We don't change the name, yet. $this->assert_equal($orig_name, $this->_photo->name); } public function change_photo_no_csrf_fails_test() { $controller = new Photos_Controller(); $root = ORM::factory("item", 1); $this->_photo = photo::create( $root, MODPATH . "gallery/tests/test.jpg", "test.jpg", "test", "test"); $_POST["name"] = "new name"; $_POST["title"] = "new title"; $_POST["description"] = "new description"; access::allow(group::everybody(), "edit", $root); try { $controller->_update($this->_photo); $this->assert_true(false, "This should fail"); } catch (Exception $e) { // pass } } }