search

RuairiK / divesit.es

A web app for locating dive sites
2 stars 1 forks source link

Route security #25

Closed sdob closed 9 years ago

sdob commented 9 years ago

As I said in the (now closed) PR that pointed to master:

Non-read-only HTTP methods on the divesite database now require authentication. Caveat: currently you can do anything to anything as long as you're authenticated; there doesn't exist any notion of 'ownership' in the db schema, so I can maliciously clobber other users' data as long as I'm authenticated.

I've added what it pleases me to call unit tests (requiring Mocha) under the 'test/" directory. Your terminology may differ since the tests are actually hitting a database, but feh.

sdob commented 9 years ago

Basic support for posting and retrieving comments on sites.