|
Lines 179-185
subtest 'XSS vulnerabilities in pagination' => sub {
Link Here
|
| 179 |
{ |
179 |
{ |
| 180 |
class => 'Koha::Virtualshelves', |
180 |
class => 'Koha::Virtualshelves', |
| 181 |
value => { |
181 |
value => { |
| 182 |
category => 2, |
182 |
public => 1, |
| 183 |
allow_change_from_owner => 1, |
183 |
allow_change_from_owner => 1, |
| 184 |
allow_change_from_others => 0, |
184 |
allow_change_from_others => 0, |
| 185 |
owner => $patron->borrowernumber |
185 |
owner => $patron->borrowernumber |
|
Lines 193-199
subtest 'XSS vulnerabilities in pagination' => sub {
Link Here
|
| 193 |
$patron->set_password({ password => $password }); |
193 |
$patron->set_password({ password => $password }); |
| 194 |
$s->opac_auth( $patron->userid, $password ); |
194 |
$s->opac_auth( $patron->userid, $password ); |
| 195 |
|
195 |
|
| 196 |
my $public_lists = $s->opac_base_url . q|opac-shelves.pl?op=list&category=2|; |
196 |
my $public_lists = $s->opac_base_url . q|opac-shelves.pl?op=list&public=1|; |
| 197 |
$driver->get($public_lists); |
197 |
$driver->get($public_lists); |
| 198 |
|
198 |
|
| 199 |
$s->remove_error_handler; |
199 |
$s->remove_error_handler; |
|
Lines 202-208
subtest 'XSS vulnerabilities in pagination' => sub {
Link Here
|
| 202 |
is( $alert_text, undef, 'No alert box displayed' ); |
202 |
is( $alert_text, undef, 'No alert box displayed' ); |
| 203 |
|
203 |
|
| 204 |
my $booh_alert = 'booh!'; |
204 |
my $booh_alert = 'booh!'; |
| 205 |
$public_lists = $s->opac_base_url . qq|opac-shelves.pl?op=list&category=2"><script>alert('$booh_alert')</script>|; |
205 |
$public_lists = $s->opac_base_url . qq|opac-shelves.pl?op=list&public=1"><script>alert('$booh_alert')</script>|; |
| 206 |
$driver->get($public_lists); |
206 |
$driver->get($public_lists); |
| 207 |
|
207 |
|
| 208 |
$s->remove_error_handler; |
208 |
$s->remove_error_handler; |
|
Lines 211-217
subtest 'XSS vulnerabilities in pagination' => sub {
Link Here
|
| 211 |
is( $alert_text, undef, 'No alert box displayed, even if evil intent' ); |
211 |
is( $alert_text, undef, 'No alert box displayed, even if evil intent' ); |
| 212 |
|
212 |
|
| 213 |
my $second_page = $driver->find_element('//div[@class="pages"]/span[@class="currentPage"]/following-sibling::a'); |
213 |
my $second_page = $driver->find_element('//div[@class="pages"]/span[@class="currentPage"]/following-sibling::a'); |
| 214 |
like( $second_page->get_attribute('href'), qr{(?|&)category=2(&|$)}, 'The second page should display category without the invalid value' ); |
214 |
like( $second_page->get_attribute('href'), qr{(?|&)public=1(&|$)}, 'The second page should display category without the invalid value' ); |
| 215 |
|
215 |
|
| 216 |
push @cleanup, $patron, $patron->category, $patron->library; |
216 |
push @cleanup, $patron, $patron->category, $patron->library; |
| 217 |
|
217 |
|