Attachment #156074 for bug #34478

View | Details | Raw Unified | Return to bug 34478
Collapse All | Expand All

Lines 7-12 export default defineConfig({ Link Here

(-)a/cypress.config.ts (+3 lines)
7	defaultCommandTimeout: 10000,	7	defaultCommandTimeout: 10000,
8		8
9	e2e: {	9	e2e: {
		10	setupNodeEvents(on, config) {
		11	return require("./t/cypress/plugins/index.js")(on, config);
		12	},
10	experimentalStudio: true,	13	experimentalStudio: true,
11	baseUrl: "http://kohadev-intra.mydnsname.org:8081",	14	baseUrl: "http://kohadev-intra.mydnsname.org:8081",
12	specPattern: "t/cypress/integration/*/.*",	15	specPattern: "t/cypress/integration/*/.*",




import { mount } from "@cypress/vue";

const branchcode = "TEST_LIB";
const branchname = "test_branchname";

function cleanup() {
    const sql = "DELETE FROM branches WHERE branchcode=?";
    cy.query(sql, branchcode);
}

describe("CSRF", () => {
    beforeEach(() => {
        cleanup();
        cy.login();
        cy.title().should("eq", "Koha staff interface");
    });

    afterEach(() => {
        cleanup();
    });

    it("Add using POST without csrf", () => {
        cy.visit("/cgi-bin/koha/admin/branches.pl");

        cy.get("#newbranch").click();
        cy.get("#Aform").find("input[name='csrf_token']").invoke("remove");
        cy.get("#branchcode").type(branchcode);
        cy.get("#branchname").type(branchname);
        cy.get("#Aform").contains("Submit").click();

        cy.get("main")
            .find(".message")
            .contains(/Wrong CSRF token/);

        cy.query(
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
            branchcode
        ).then(result => {
            expect(result[0].count).to.equal(0);
        });
    });

    it("Add using GET", () => {
        // Trying correct op=cud-add_validate
        cy.visit(
            "/cgi-bin/koha/admin/branches.pl?op=cud-add_validate&branchcode=" +
                branchcode +
                "&branchname=" +
                branchname
        );

        // We do not display a message
        // We do not want Wrong CSRF token here
        cy.get(".message").should("not.exist");

        // Trying incorrect op=add_validate
        cy.visit(
            "/cgi-bin/koha/admin/branches.pl?op=add_validate&branchcode=" +
                branchcode +
                "&branchname=" +
                branchname
        );

        // We do not display a message
        // We do not want Wrong CSRF token here
        cy.get(".message").should("not.exist");

        cy.query(
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
            branchcode
        ).then(result => {
            expect(result[0].count).to.equal(0);
        });
    });

    it("Add", () => {
        cy.visit("/cgi-bin/koha/admin/branches.pl");

        cy.get("#newbranch").click();
        cy.get("#branchcode").type(branchcode);
        cy.get("#branchname").type(branchname);
        cy.get("#Aform").contains("Submit").click();

        cy.get("main")
            .find(".message")
            .contains(/Library added successfully/);

        cy.get("select[name='libraries_length']").select("-1");
        cy.get("td").contains(branchcode);

        cy.query(
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
            branchcode
        ).then(result => {
            expect(result[0].count).to.equal(1);
        });
    });

    it("Delete without CSRF", () => {
        cy.query("INSERT INTO branches(branchcode, branchname) VALUES (?, ?)", [
            branchcode,
            branchname,
        ]);

        cy.visit("/cgi-bin/koha/admin/branches.pl");
        cy.get("select[name='libraries_length']").select("-1");
        cy.get("#delete_library_" + branchcode).click();

        // Remove CSRF Token
        cy.get("form[method='post']")
            .find("input[name='csrf_token']")
            .invoke("remove");

        cy.contains("Yes, delete").click();

        cy.get("main")
            .find(".message")
            .contains(/Wrong CSRF token/);

        cy.query(
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
            branchcode
        ).then(result => {
            expect(result[0].count).to.equal(1);
        });
    });

    it("Delete", () => {
        cy.query("INSERT INTO branches(branchcode, branchname) VALUES (?, ?)", [
            branchcode,
            branchname,
        ]);

        cy.visit("/cgi-bin/koha/admin/branches.pl");
        cy.get("select[name='libraries_length']").select("-1");
        cy.get("#delete_library_" + branchcode).click();

        cy.contains("Yes, delete").click();

        cy.get("main")
            .find(".message")
            .contains(/Library deleted successfully/);

        cy.query(
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
            branchcode
        ).then(result => {
            expect(result[0].count).to.equal(0);
        });
    });
});

Return to bug 34478

Line 0 Link Here

(-)a/t/cypress/integration/Auth/csrf.ts (-1 / +151 lines)
0	-	1	import { mount } from "@cypress/vue";
		2
		3	const branchcode = "TEST_LIB";
		4	const branchname = "test_branchname";
		5
		6	function cleanup() {
		7	const sql = "DELETE FROM branches WHERE branchcode=?";
		8	cy.query(sql, branchcode);
		9	}
		10
		11	describe("CSRF", () => {
		12	beforeEach(() => {
		13	cleanup();
		14	cy.login();
		15	cy.title().should("eq", "Koha staff interface");
		16	});
		17
		18	afterEach(() => {
		19	cleanup();
		20	});
		21
		22	it("Add using POST without csrf", () => {
		23	cy.visit("/cgi-bin/koha/admin/branches.pl");
		24
		25	cy.get("#newbranch").click();
		26	cy.get("#Aform").find("input[name='csrf_token']").invoke("remove");
		27	cy.get("#branchcode").type(branchcode);
		28	cy.get("#branchname").type(branchname);
		29	cy.get("#Aform").contains("Submit").click();
		30
		31	cy.get("main")
		32	.find(".message")
		33	.contains(/Wrong CSRF token/);
		34
		35	cy.query(
		36	"SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
		37	branchcode
		38	).then(result => {
		39	expect(result[0].count).to.equal(0);
		40	});
		41	});
		42
		43	it("Add using GET", () => {
		44	// Trying correct op=cud-add_validate
		45	cy.visit(
		46	"/cgi-bin/koha/admin/branches.pl?op=cud-add_validate&branchcode=" +
		47	branchcode +
		48	"&branchname=" +
		49	branchname
		50	);
		51
		52	// We do not display a message
		53	// We do not want Wrong CSRF token here
		54	cy.get(".message").should("not.exist");
		55
		56	// Trying incorrect op=add_validate
		57	cy.visit(
		58	"/cgi-bin/koha/admin/branches.pl?op=add_validate&branchcode=" +
		59	branchcode +
		60	"&branchname=" +
		61	branchname
		62	);
		63
		64	// We do not display a message
		65	// We do not want Wrong CSRF token here
66	cy.get(".message").should("not.exist");
67
68	cy.query(
69	"SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
70	branchcode
71	).then(result => {
72	expect(result[0].count).to.equal(0);
73	});
74	});
75
76	it("Add", () => {
77	cy.visit("/cgi-bin/koha/admin/branches.pl");
78
79	cy.get("#newbranch").click();
80	cy.get("#branchcode").type(branchcode);
81	cy.get("#branchname").type(branchname);
82	cy.get("#Aform").contains("Submit").click();
83
84	cy.get("main")
85	.find(".message")
86	.contains(/Library added successfully/);
87
88	cy.get("select[name='libraries_length']").select("-1");
89	cy.get("td").contains(branchcode);
90
91	cy.query(
92	"SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
93	branchcode
94	).then(result => {
95	expect(result[0].count).to.equal(1);
96	});
97	});
98
99	it("Delete without CSRF", () => {
100	cy.query("INSERT INTO branches(branchcode, branchname) VALUES (?, ?)", [
101	branchcode,
102	branchname,
103	]);
104
105	cy.visit("/cgi-bin/koha/admin/branches.pl");
106	cy.get("select[name='libraries_length']").select("-1");
107	cy.get("#delete_library_" + branchcode).click();
108
109	// Remove CSRF Token
110	cy.get("form[method='post']")
111	.find("input[name='csrf_token']")
112	.invoke("remove");
113
114	cy.contains("Yes, delete").click();
115
116	cy.get("main")
117	.find(".message")
118	.contains(/Wrong CSRF token/);
119
120	cy.query(
121	"SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
122	branchcode
123	).then(result => {
124	expect(result[0].count).to.equal(1);
125	});
126	});
127
128	it("Delete", () => {
129	cy.query("INSERT INTO branches(branchcode, branchname) VALUES (?, ?)", [
130	branchcode,
131	branchname,
132	]);
133
134	cy.visit("/cgi-bin/koha/admin/branches.pl");
135	cy.get("select[name='libraries_length']").select("-1");
136	cy.get("#delete_library_" + branchcode).click();
137
138	cy.contains("Yes, delete").click();
139
140	cy.get("main")
141	.find(".message")
142	.contains(/Library deleted successfully/);
143
144	cy.query(
145	"SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
146	branchcode
147	).then(result => {
148	expect(result[0].count).to.equal(0);
149	});
150	});
151	});