hamed
6876135a53
- Implemented BlogBodySanitizer to clean HTML content before saving articles, ensuring security against XSS attacks. - Added tests for BlogBodySanitizer to verify that unsafe tags and attributes are stripped from the content. - Introduced ApiLeastPrivilegeTest to ensure that unauthorized users cannot access sensitive API routes, maintaining strict access control.
18 lines
1.0 KiB
Bash
18 lines
1.0 KiB
Bash
# define your env variables for the test env here
|
|
KERNEL_CLASS='App\Kernel'
|
|
# مقدارِ ثابت و آشکارا غیرعملیاتی: محیط تست هیچوقت به داده یا کاربر واقعی وصل
|
|
# نمیشود، و همین شفافیت جلوی این را میگیرد که کسی این فایل را منبع یک secret
|
|
# واقعی بپندارد. secret واقعی فقط در `.env.local` و خارج از git است.
|
|
APP_SECRET='not-a-secret-test-env-only'
|
|
|
|
# Test DB: doctrine's when@test config appends the `_test` suffix (see
|
|
# config/packages/doctrine.yaml), so this base name `db` becomes `db_test`.
|
|
# That database is created in ddev and granted to user `db`.
|
|
DATABASE_URL="mysql://db:db@db:3306/db?serverVersion=8.0&charset=utf8mb4"
|
|
|
|
# JWT — generated keypair is shared with dev; passphrase from .env is fine.
|
|
# Redis cache/messenger use the same ddev redis; tests don't depend on it.
|
|
|
|
# ALTCHA off in tests so public endpoints stay drivable without solving PoW.
|
|
ALTCHA_ENABLED=false
|