X-Git-Url: http://source.bookstackapp.com/bookstack/blobdiff_plain/fd26f54b9954cc2a44d9f5f71e4258decf90558e..refs/pull/5280/head:/tests/SecurityHeaderTest.php

diff --git a/tests/SecurityHeaderTest.php b/tests/SecurityHeaderTest.php
index 1a0a6c9b3..5d354e553 100644
--- a/tests/SecurityHeaderTest.php
+++ b/tests/SecurityHeaderTest.php
@@ -3,6 +3,7 @@
 namespace Tests;
 
 use BookStack\Util\CspService;
+use Illuminate\Testing\TestResponse;
 
 class SecurityHeaderTest extends TestCase
 {
@@ -130,7 +131,7 @@ class SecurityHeaderTest extends TestCase
     {
         config()->set([
             'app.iframe_sources' => 'https://example.com',
-            'services.drawio'   => 'https://diagrams.example.com/testing?cat=dog',
+            'services.drawio'    => 'https://diagrams.example.com/testing?cat=dog',
         ]);
 
         $resp = $this->get('/');
@@ -138,12 +139,29 @@ class SecurityHeaderTest extends TestCase
         $this->assertEquals('frame-src \'self\' https://example.com https://diagrams.example.com', $scriptHeader);
     }
 
-    public function test_cache_control_headers_are_strict_on_responses_when_logged_in()
+    public function test_frame_src_csp_header_drawio_host_includes_port_if_existing()
     {
+        config()->set([
+            'app.iframe_sources' => 'https://example.com',
+            'services.drawio'    => 'https://diagrams.example.com:8080/testing?cat=dog',
+        ]);
+
+        $resp = $this->get('/');
+        $scriptHeader = $this->getCspHeader($resp, 'frame-src');
+        $this->assertEquals('frame-src \'self\' https://example.com https://diagrams.example.com:8080', $scriptHeader);
+    }
+
+    public function test_cache_control_headers_are_set_on_responses()
+    {
+        // Public access
+        $resp = $this->get('/');
+        $resp->assertHeader('Cache-Control', 'no-cache, no-store, private');
+        $resp->assertHeader('Expires', 'Sun, 12 Jul 2015 19:01:00 GMT');
+
+        // Authed access
         $this->asEditor();
         $resp = $this->get('/');
-        $resp->assertHeader('Cache-Control', 'max-age=0, no-store, private');
-        $resp->assertHeader('Pragma', 'no-cache');
+        $resp->assertHeader('Cache-Control', 'no-cache, no-store, private');
         $resp->assertHeader('Expires', 'Sun, 12 Jul 2015 19:01:00 GMT');
     }