View | Details | Raw Unified | Return to bug 34478
Collapse All | Expand All

(-)a/cypress.config.ts (+3 lines)
Lines 7-12 export default defineConfig({ Link Here
7
    defaultCommandTimeout: 10000,
7
    defaultCommandTimeout: 10000,
8
8
9
    e2e: {
9
    e2e: {
10
        setupNodeEvents(on, config) {
11
            return require("./t/cypress/plugins/index.js")(on, config);
12
        },
10
        experimentalStudio: true,
13
        experimentalStudio: true,
11
        baseUrl: "http://kohadev-intra.mydnsname.org:8081",
14
        baseUrl: "http://kohadev-intra.mydnsname.org:8081",
12
        specPattern: "t/cypress/integration/**/*.*",
15
        specPattern: "t/cypress/integration/**/*.*",
(-)a/t/cypress/integration/Auth/csrf.ts (-1 / +151 lines)
Line 0 Link Here
0
- 
1
import { mount } from "@cypress/vue";
2
3
const branchcode = "TEST_LIB";
4
const branchname = "test_branchname";
5
6
function cleanup() {
7
    const sql = "DELETE FROM branches WHERE branchcode=?";
8
    cy.query(sql, branchcode);
9
}
10
11
describe("CSRF", () => {
12
    beforeEach(() => {
13
        cleanup();
14
        cy.login();
15
        cy.title().should("eq", "Koha staff interface");
16
    });
17
18
    afterEach(() => {
19
        cleanup();
20
    });
21
22
    it("Add using POST without csrf", () => {
23
        cy.visit("/cgi-bin/koha/admin/branches.pl");
24
25
        cy.get("#newbranch").click();
26
        cy.get("#Aform").find("input[name='csrf_token']").invoke("remove");
27
        cy.get("#branchcode").type(branchcode);
28
        cy.get("#branchname").type(branchname);
29
        cy.get("#Aform").contains("Submit").click();
30
31
        cy.get("main")
32
            .find(".message")
33
            .contains(/Wrong CSRF token/);
34
35
        cy.query(
36
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
37
            branchcode
38
        ).then(result => {
39
            expect(result[0].count).to.equal(0);
40
        });
41
    });
42
43
    it("Add using GET", () => {
44
        // Trying correct op=cud-add_validate
45
        cy.visit(
46
            "/cgi-bin/koha/admin/branches.pl?op=cud-add_validate&branchcode=" +
47
                branchcode +
48
                "&branchname=" +
49
                branchname
50
        );
51
52
        // We do not display a message
53
        // We do not want Wrong CSRF token here
54
        cy.get(".message").should("not.exist");
55
56
        // Trying incorrect op=add_validate
57
        cy.visit(
58
            "/cgi-bin/koha/admin/branches.pl?op=add_validate&branchcode=" +
59
                branchcode +
60
                "&branchname=" +
61
                branchname
62
        );
63
64
        // We do not display a message
65
        // We do not want Wrong CSRF token here
66
        cy.get(".message").should("not.exist");
67
68
        cy.query(
69
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
70
            branchcode
71
        ).then(result => {
72
            expect(result[0].count).to.equal(0);
73
        });
74
    });
75
76
    it("Add", () => {
77
        cy.visit("/cgi-bin/koha/admin/branches.pl");
78
79
        cy.get("#newbranch").click();
80
        cy.get("#branchcode").type(branchcode);
81
        cy.get("#branchname").type(branchname);
82
        cy.get("#Aform").contains("Submit").click();
83
84
        cy.get("main")
85
            .find(".message")
86
            .contains(/Library added successfully/);
87
88
        cy.get("select[name='libraries_length']").select("-1");
89
        cy.get("td").contains(branchcode);
90
91
        cy.query(
92
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
93
            branchcode
94
        ).then(result => {
95
            expect(result[0].count).to.equal(1);
96
        });
97
    });
98
99
    it("Delete without CSRF", () => {
100
        cy.query("INSERT INTO branches(branchcode, branchname) VALUES (?, ?)", [
101
            branchcode,
102
            branchname,
103
        ]);
104
105
        cy.visit("/cgi-bin/koha/admin/branches.pl");
106
        cy.get("select[name='libraries_length']").select("-1");
107
        cy.get("#delete_library_" + branchcode).click();
108
109
        // Remove CSRF Token
110
        cy.get("form[method='post']")
111
            .find("input[name='csrf_token']")
112
            .invoke("remove");
113
114
        cy.contains("Yes, delete").click();
115
116
        cy.get("main")
117
            .find(".message")
118
            .contains(/Wrong CSRF token/);
119
120
        cy.query(
121
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
122
            branchcode
123
        ).then(result => {
124
            expect(result[0].count).to.equal(1);
125
        });
126
    });
127
128
    it("Delete", () => {
129
        cy.query("INSERT INTO branches(branchcode, branchname) VALUES (?, ?)", [
130
            branchcode,
131
            branchname,
132
        ]);
133
134
        cy.visit("/cgi-bin/koha/admin/branches.pl");
135
        cy.get("select[name='libraries_length']").select("-1");
136
        cy.get("#delete_library_" + branchcode).click();
137
138
        cy.contains("Yes, delete").click();
139
140
        cy.get("main")
141
            .find(".message")
142
            .contains(/Library deleted successfully/);
143
144
        cy.query(
145
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
146
            branchcode
147
        ).then(result => {
148
            expect(result[0].count).to.equal(0);
149
        });
150
    });
151
});

Return to bug 34478