Bug 34426 - Add tests for CSRF checks missing
Summary: Add tests for CSRF checks missing
Status: Pushed to main
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement
Assignee: Martin Renvoize (ashimema)
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on: 30524
Blocks: 34478
  Show dependency treegraph
 
Reported: 2023-07-26 20:59 UTC by Tomás Cohen Arazi (tcohen)
Modified: 2024-03-01 13:18 UTC (History)
11 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00
Circulation function:


Attachments
Bug 34426: Add xt/find-missing-csrf.t (3.16 KB, patch)
2023-07-26 21:04 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 34426: (QA follow-up) Polishing xt script (1.92 KB, patch)
2023-07-26 21:04 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Tomás Cohen Arazi (tcohen) 2023-07-26 20:59:41 UTC
See bug 30524.
Comment 1 Tomás Cohen Arazi (tcohen) 2023-07-26 21:04:18 UTC
Created attachment 153940 [details] [review]
Bug 34426: Add xt/find-missing-csrf.t

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 2 Tomás Cohen Arazi (tcohen) 2023-07-26 21:04:54 UTC
Created attachment 153941 [details] [review]
Bug 34426: (QA follow-up) Polishing xt script

Test plan:
Run it again. Same results?

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 3 Martin Renvoize (ashimema) 2023-07-27 08:23:28 UTC
Marking blocked to make sure it's not accidentally picked before we're resolved all the existing cases.. we should definitely use this to help us find and fix all the remainin occurences.
Comment 4 David Cook 2023-08-01 01:03:32 UTC
(In reply to Martin Renvoize from comment #3)
> Marking blocked to make sure it's not accidentally picked before we're
> resolved all the existing cases.. we should definitely use this to help us
> find and fix all the remainin occurences.

+1
Comment 5 Jonathan Druart 2023-08-01 15:21:29 UTC
I guess there is as well the POST/PUT/DELETE/PATCH from the js files. They are mainly about the svc scripts.
Comment 6 Jonathan Druart 2023-08-04 07:06:04 UTC
 59 is( @errors, 0, "Template variables should be correctly escaped" )
 60     or diag(Dumper @errors);

This should be removed.
Comment 7 Jonathan Druart 2023-08-04 07:41:13 UTC
There are 2 occurrences of method="GET" that this script is not catching.
Comment 8 Jonathan Druart 2024-02-28 13:43:32 UTC
This will be embedded with bug 34478.
Comment 9 Jonathan Druart 2024-03-01 13:17:58 UTC
Pushed to master for 24.05.00.