|
Line 0
Link Here
|
| 0 |
- |
1 |
#!/usr/bin/perl |
|
|
2 |
|
| 3 |
# This file is part of Koha. |
| 4 |
# |
| 5 |
# Koha is free software; you can redistribute it and/or modify it |
| 6 |
# under the terms of the GNU General Public License as published by |
| 7 |
# the Free Software Foundation; either version 3 of the License, or |
| 8 |
# (at your option) any later version. |
| 9 |
# |
| 10 |
# Koha is distributed in the hope that it will be useful, but |
| 11 |
# WITHOUT ANY WARRANTY; without even the implied warranty of |
| 12 |
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 13 |
# GNU General Public License for more details. |
| 14 |
# |
| 15 |
# You should have received a copy of the GNU General Public License |
| 16 |
# along with Koha; if not, see <http://www.gnu.org/licenses>. |
| 17 |
|
| 18 |
use Modern::Perl; |
| 19 |
use Test::More tests => 1; |
| 20 |
use File::Find; |
| 21 |
use File::Slurp; |
| 22 |
use Data::Dumper; |
| 23 |
|
| 24 |
my @themes; |
| 25 |
|
| 26 |
# OPAC themes |
| 27 |
my $opac_dir = 'koha-tmpl/opac-tmpl'; |
| 28 |
opendir ( my $dh, $opac_dir ) or die "can't opendir $opac_dir: $!"; |
| 29 |
for my $theme ( grep { not /^\.|lib|js|xslt/ } readdir($dh) ) { |
| 30 |
push @themes, "$opac_dir/$theme/en"; |
| 31 |
} |
| 32 |
close $dh; |
| 33 |
|
| 34 |
# STAFF themes |
| 35 |
my $staff_dir = 'koha-tmpl/intranet-tmpl'; |
| 36 |
opendir ( $dh, $staff_dir ) or die "can't opendir $staff_dir: $!"; |
| 37 |
for my $theme ( grep { not /^\.|lib|js/ } readdir($dh) ) { |
| 38 |
push @themes, "$staff_dir/$theme/en"; |
| 39 |
} |
| 40 |
close $dh; |
| 41 |
|
| 42 |
my @files; |
| 43 |
sub wanted { |
| 44 |
my $name = $File::Find::name; |
| 45 |
push @files, $name |
| 46 |
if $name =~ m[\.(tt|inc)$] and -f $name; |
| 47 |
} |
| 48 |
|
| 49 |
find({ wanted => \&wanted, no_chdir => 1 }, @themes ); |
| 50 |
|
| 51 |
my @errors; |
| 52 |
for my $file ( @files ) { |
| 53 |
my @e = check_csrf_in_forms($file); |
| 54 |
push @errors, { file => $file, errors => \@e } if @e; |
| 55 |
} |
| 56 |
|
| 57 |
is( @errors, 0, "Template variables should be correctly escaped" ) |
| 58 |
or diag(Dumper @errors); |
| 59 |
|
| 60 |
sub check_csrf_in_forms { |
| 61 |
my ( $file ) = @_; |
| 62 |
|
| 63 |
my @lines = read_file($file); |
| 64 |
my @errors; |
| 65 |
return @errors unless grep { $_ =~ m|<form| } @lines; |
| 66 |
my ( $open, $found, $closed ) = ( 0, 0, 0 ); |
| 67 |
my $line = 0 ; |
| 68 |
for my $l (@lines) { |
| 69 |
$line++; |
| 70 |
$open = $line if ( $l =~ m{<form} && !($l =~ m{method=('|")get('|")})); |
| 71 |
$found++ if ($l =~ m|csrf\-token\.inc| && $open); |
| 72 |
$closed++ if ($l =~ m|</form| && $open); |
| 73 |
if ( $open && $closed ) { |
| 74 |
push @errors, "The <form> starting on line $open is missing it's corresponding csrf_token include (see bug 22990)" |
| 75 |
if !$found; |
| 76 |
|
| 77 |
# reset |
| 78 |
( $open, $found, $closed ) = ( 0, 0, 0 ); |
| 79 |
} |
| 80 |
} |
| 81 |
return @errors; |
| 82 |
} |