diff --git a/src/backend/InvenTree/common/tests.py b/src/backend/InvenTree/common/tests.py index aade04e30f..9c1ed61a3a 100644 --- a/src/backend/InvenTree/common/tests.py +++ b/src/backend/InvenTree/common/tests.py @@ -1669,31 +1669,6 @@ class NotesImageTest(InvenTreeAPITestCase): # Check that no extra database entries have been created self.assertEqual(NotesImage.objects.count(), n) - def test_valid_image(self): - """Test upload of a valid image file.""" - n = NotesImage.objects.count() - - # Construct a simple image file - image = Image.new('RGB', (100, 100), color='red') - - with io.BytesIO() as output: - image.save(output, format='PNG') - contents = output.getvalue() - - self.post( - reverse('api-notes-image-list'), - data={ - 'image': SimpleUploadedFile( - 'test.png', contents, content_type='image/png' - ) - }, - format='multipart', - expected_code=201, - ) - - # Check that a new file has been created - self.assertEqual(NotesImage.objects.count(), n + 1) - def test_image_cleanup(self): """Images no longer referenced in note content are deleted when the note is saved. diff --git a/src/backend/InvenTree/company/test_api.py b/src/backend/InvenTree/company/test_api.py index 8570991643..53da8725db 100644 --- a/src/backend/InvenTree/company/test_api.py +++ b/src/backend/InvenTree/company/test_api.py @@ -161,55 +161,6 @@ class CompanyTest(InvenTreeAPITestCase): len(self.get(url, data={'active': False}, expected_code=200).data), 1 ) - def test_company_notes(self): - """Test the markdown 'notes' field for the Company model.""" - company = Company.objects.first() - assert company - pk = company.pk - - url = reverse('api-company-detail', kwargs={'pk': pk}) - - # Attempt to inject malicious markdown into the "notes" field - xss = [ - '[Click me](javascript:alert(123))', - '![x](javascript:alert(123))', - '![Uh oh...]("onerror="alert(\'XSS\'))', - ] - - for note in xss: - response = self.patch(url, {'notes': note}, expected_code=400) - - self.assertIn( - 'Data contains prohibited markdown content', str(response.data) - ) - - # Tests with disallowed tags - invalid_tags = [ - '', - 'A disallowed tag!', - ] - - for note in invalid_tags: - response = self.patch(url, {'notes': note}, expected_code=400) - - self.assertIn('Remove HTML tags from this value', str(response.data)) - - # The following markdown is safe, and should be accepted - good = [ - 'This is a **bold** statement', - 'This is a *italic* statement', - 'This is a [link](https://www.google.com)', - 'This is an ![image](https://www.google.com/test.jpg)', - 'This is a `code` block', - 'This text has ~~strikethrough~~ formatting', - 'This text has a raw link - https://www.google.com - and should still pass the test', - ] - - for note in good: - response = self.patch(url, {'notes': note}, expected_code=200) - - self.assertEqual(response.data['notes'], note) - def test_company_parameters(self): """Test for annotation of 'parameters' field in Company API.""" url = reverse('api-company-list') diff --git a/src/backend/InvenTree/part/test_api.py b/src/backend/InvenTree/part/test_api.py index d1adcef0f7..787cc07f53 100644 --- a/src/backend/InvenTree/part/test_api.py +++ b/src/backend/InvenTree/part/test_api.py @@ -1363,23 +1363,6 @@ class PartAPITest(PartAPITestBase): date = datetime.fromisoformat(item['creation_date']) self.assertGreaterEqual(date, date_compare) - def test_part_notes(self): - """Test the 'notes' field.""" - # First test the 'LIST' endpoint - no notes information provided - url = reverse('api-part-list') - - response = self.get(url, {'limit': 1}, expected_code=200) - data = response.data['results'][0] - - self.assertNotIn('notes', data) - - # Second, test the 'DETAIL' endpoint - notes information provided - url = reverse('api-part-detail', kwargs={'pk': data['pk']}) - - response = self.get(url, expected_code=200) - - self.assertIn('notes', response.data) - def test_output_options(self): """Test the output options for PartList list.""" self.run_output_test(