See bug 30524.
Created attachment 153940 [details] [review] Bug 34426: Add xt/find-missing-csrf.t Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 153941 [details] [review] Bug 34426: (QA follow-up) Polishing xt script Test plan: Run it again. Same results? Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Marking blocked to make sure it's not accidentally picked before we're resolved all the existing cases.. we should definitely use this to help us find and fix all the remainin occurences.
(In reply to Martin Renvoize from comment #3) > Marking blocked to make sure it's not accidentally picked before we're > resolved all the existing cases.. we should definitely use this to help us > find and fix all the remainin occurences. +1
I guess there is as well the POST/PUT/DELETE/PATCH from the js files. They are mainly about the svc scripts.
59 is( @errors, 0, "Template variables should be correctly escaped" ) 60 or diag(Dumper @errors); This should be removed.
There are 2 occurrences of method="GET" that this script is not catching.
This will be embedded with bug 34478.
Pushed to master for 24.05.00.