| Line 0
          
      
      
        Link Here | 
          
            
              | 0 | -  | 1 | #!/usr/bin/perl | 
            
              |  |  | 2 |  | 
            
              | 3 | # This file is part of Koha. | 
            
              | 4 | # | 
            
              | 5 | # Koha is free software; you can redistribute it and/or modify it | 
            
              | 6 | # under the terms of the GNU General Public License as published by | 
            
              | 7 | # the Free Software Foundation; either version 3 of the License, or | 
            
              | 8 | # (at your option) any later version. | 
            
              | 9 | # | 
            
              | 10 | # Koha is distributed in the hope that it will be useful, but | 
            
              | 11 | # WITHOUT ANY WARRANTY; without even the implied warranty of | 
            
              | 12 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | 
            
              | 13 | # GNU General Public License for more details. | 
            
              | 14 | # | 
            
              | 15 | # You should have received a copy of the GNU General Public License | 
            
              | 16 | # along with Koha; if not, see <http://www.gnu.org/licenses>. | 
            
              | 17 |  | 
            
              | 18 | use Modern::Perl; | 
            
              | 19 | use Test::More tests => 1; | 
            
              | 20 | use File::Find; | 
            
              | 21 | use File::Slurp; | 
            
              | 22 | use Data::Dumper; | 
            
              | 23 |  | 
            
              | 24 | my @themes; | 
            
              | 25 |  | 
            
              | 26 | # OPAC themes | 
            
              | 27 | my $opac_dir  = 'koha-tmpl/opac-tmpl'; | 
            
              | 28 | opendir ( my $dh, $opac_dir ) or die "can't opendir $opac_dir: $!"; | 
            
              | 29 | for my $theme ( grep { not /^\.|lib|js|xslt/ } readdir($dh) ) { | 
            
              | 30 |     push @themes, "$opac_dir/$theme/en"; | 
            
              | 31 | } | 
            
              | 32 | close $dh; | 
            
              | 33 |  | 
            
              | 34 | # STAFF themes | 
            
              | 35 | my $staff_dir = 'koha-tmpl/intranet-tmpl'; | 
            
              | 36 | opendir ( $dh, $staff_dir ) or die "can't opendir $staff_dir: $!"; | 
            
              | 37 | for my $theme ( grep { not /^\.|lib|js/ } readdir($dh) ) { | 
            
              | 38 |     push @themes, "$staff_dir/$theme/en"; | 
            
              | 39 | } | 
            
              | 40 | close $dh; | 
            
              | 41 |  | 
            
              | 42 | my @files; | 
            
              | 43 | sub wanted { | 
            
              | 44 |     my $name = $File::Find::name; | 
            
              | 45 |     push @files, $name | 
            
              | 46 |         if $name =~ m[\.(tt|inc)$] and -f $name; | 
            
              | 47 | } | 
            
              | 48 |  | 
            
              | 49 | find({ wanted => \&wanted, no_chdir => 1 }, @themes ); | 
            
              | 50 |  | 
            
              | 51 | my @errors; | 
            
              | 52 | for my $file ( @files ) { | 
            
              | 53 |     my @e = check_csrf_in_forms($file); | 
            
              | 54 |     push @errors, { file => $file, errors => \@e } if @e; | 
            
              | 55 | } | 
            
              | 56 |  | 
            
              | 57 | is( @errors, 0, "Template variables should be correctly escaped" ) | 
            
              | 58 |     or diag(Dumper @errors); | 
            
              | 59 |  | 
            
              | 60 | sub check_csrf_in_forms { | 
            
              | 61 |     my ( $file ) = @_; | 
            
              | 62 |  | 
            
              | 63 |     my @lines = read_file($file); | 
            
              | 64 |     my @errors; | 
            
              | 65 |     return @errors unless grep { $_ =~ m|<form| } @lines; | 
            
              | 66 |     my ( $open, $found, $closed ) = ( 0, 0, 0 ); | 
            
              | 67 |     my $line = 0 ; | 
            
              | 68 |     for my $l (@lines) { | 
            
              | 69 |         $line++; | 
            
              | 70 |         $open = $line if ( $l =~ m{<form} && !($l =~ m{method=('|")get('|")})); | 
            
              | 71 |         $found++  if ($l =~ m|csrf\-token\.inc| && $open); | 
            
              | 72 |         $closed++ if ($l =~ m|</form| && $open); | 
            
              | 73 |         if ( $open && $closed ) { | 
            
              | 74 |             push @errors, "The <form> starting on line $open is missing it's corresponding csrf_token include (see bug 22990)" | 
            
              | 75 |               if !$found; | 
            
              | 76 |  | 
            
              | 77 |             # reset | 
            
              | 78 |             ( $open, $found, $closed ) = ( 0, 0, 0 ); | 
            
              | 79 |         } | 
            
              | 80 |     } | 
            
              | 81 |     return @errors; | 
            
              | 82 | } |