message: Give product tampering request +1sec to complete
diff: const config = require('config')
  -const tamperingProductId = ((() => {
  - const products = config.get('products')
  - for (let i = 0; i < products.length; i++) {
  - if (products[i].urlForProductTamperingChallenge) {
  - return i + 1
  - }
  - }
  -})())
  describe('/api', () => {
  describe('challenge "xss3"', () => {
  @@ -37,10 +29,19 @@ describe('/api', () => {
  })
  describe('challenge "changeProduct"', () => {
  + const tamperingProductId = ((() => {
  + const products = config.get('products')
  + for (let i = 0; i < products.length; i++) {
  + if (products[i].urlForProductTamperingChallenge) {
  + return i + 1
  + }
  + }
  + })())
  +
  it('should be possible to change product via PUT request without being logged in', () => {
  browser.waitForAngularEnabled(false)
  browser.executeScript(`var xhttp = new XMLHttpRequest(); xhttp.onreadystatechange = function() { if (this.status == 200) { console.log("Success"); } }; xhttp.open("PUT","${"http://localhost:3000/api/Products/" + tamperingProductId}", true); xhttp.setRequestHeader("Content-type","application/json"); xhttp.send(JSON.stringify({"description" : "<a href=\\"http://kimminich.de\\" target=\\"_blank\\">More...</a>"}));`) // eslint-disable-line
  - browser.driver.sleep(1000)
  + browser.driver.sleep(2000)
  browser.waitForAngularEnabled(true)
  browser.get('/#/search')
  