admin-asset-gate

第 20260916-181749 轮 · 看它的历史
  ✔ ① 未登录 asset_group_list → unauthorized(既有行为不变)  got="unauthorized" want="unauthorized"
  ✔ ② 持位12者 asset_group_list 未被拒  got=true want=true
  ✔ ② 且 info==1(闸没有误伤正常路径)  got="1" want="1"
  ✔ ③ GET 写端点 → method_not_allowed  got="method_not_allowed" want="method_not_allowed"
  ✔ ③ POST 无 token → csrf_invalid  got="csrf_invalid" want="csrf_invalid"
  ✔ ③ asset_debug_csrf_token 能取到 token  got=true want=true
  ✔ ③ POST 带 token → 穿过 CSRF 闸(errCode 不再是 csrf_invalid)  got=true want=true
  ✔ ④ ckeditor_upload 回的是 CKEDITOR 回调形态  got=true want=true
  ✔ ④ 且不是"没有上传图片的权限"(持位者未被拦)  got=false want=false

=== PASS=9 FAIL=0 ===