Attachment #162534 for bug #36177

View | Details | Raw Unified | Return to bug 36177
Collapse All | Expand All

Lines 7-12 export default defineConfig({ Link Here

(-)a/cypress.config.ts (+3 lines)
7	defaultCommandTimeout: 10000,	7	defaultCommandTimeout: 10000,
8		8
9	e2e: {	9	e2e: {
		10	setupNodeEvents(on, config) {
		11	return require("./t/cypress/plugins/index.js")(on, config);
		12	},
10	experimentalStudio: true,	13	experimentalStudio: true,
11	baseUrl: "http://kohadev-intra.mydnsname.org:8081",	14	baseUrl: "http://kohadev-intra.mydnsname.org:8081",
12	specPattern: "t/cypress/integration/*/.*",	15	specPattern: "t/cypress/integration/*/.*",




import { mount } from "@cypress/vue";

const branchcode = "TEST_LIB";
const branchname = "test_branchname";

function cleanup() {
    const sql = "DELETE FROM branches WHERE branchcode=?";
    cy.query(sql, branchcode);
}

describe("CSRF", () => {
    beforeEach(() => {
        cleanup();
        cy.login();
        cy.title().should("eq", "Koha staff interface");
    });

    afterEach(() => {
        cleanup();
    });

    it("Add using POST without csrf", () => {
        cy.visit("/cgi-bin/koha/admin/branches.pl");

        cy.get("#newbranch").click();
        cy.get("#Aform").find("input[name='csrf_token']").invoke("remove");
        cy.get("#branchcode").type(branchcode);
        cy.get("#branchname").type(branchname);
        cy.get("#Aform").contains("Submit").click();

        cy.get(".main")
            .find(".alert")
            .contains(/No CSRF token passed for POST/);

        cy.query(
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
            branchcode
        ).then(result => {
            expect(result[0].count).to.equal(0);
        });
    });

    it("Add using POST with invalid csrf", () => {
        cy.visit("/cgi-bin/koha/admin/branches.pl");

        cy.get("#newbranch").click();
        cy.get("#Aform").find("input[name='csrf_token']").invoke("val", "foo");
        cy.get("#branchcode").type(branchcode);
        cy.get("#branchname").type(branchname);
        cy.get("#Aform").contains("Submit").click();

        cy.get(".main")
            .find(".alert")
            .contains(/Wrong CSRF token/);

        cy.query(
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
            branchcode
        ).then(result => {
            expect(result[0].count).to.equal(0);
        });
    });

    it("Add using GET", () => {
        // Trying correct op=cud-add_validate
        cy.visit(
            "/cgi-bin/koha/admin/branches.pl?op=cud-add_validate&branchcode=" +
                branchcode +
                "&branchname=" +
                branchname,
            { failOnStatusCode: false }
        );

        cy.get(".main")
            .find(".alert")
            .contains(
                /Programming error - op 'cud-add_validate' must not start with 'cud-' for GET/
            );

        // Trying incorrect op=add_validate
        cy.visit(
            "/cgi-bin/koha/admin/branches.pl?op=add_validate&branchcode=" +
                branchcode +
                "&branchname=" +
                branchname
        );

        // We do not display a message
        // We do not want Wrong CSRF token here
        cy.get(".message").should("not.exist");

        cy.query(
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
            branchcode
        ).then(result => {
            expect(result[0].count).to.equal(0);
        });
    });

    it("Add", () => {
        cy.visit("/cgi-bin/koha/admin/branches.pl");

        cy.get("#newbranch").click();
        cy.get("#branchcode").type(branchcode);
        cy.get("#branchname").type(branchname);
        cy.get("#Aform").contains("Submit").click();

        cy.get(".main")
            .find(".message")
            .contains(/Library added successfully/);

        cy.get("select[name='libraries_length']").select("-1");
        cy.get("td").contains(branchcode);

        cy.query(
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
            branchcode
        ).then(result => {
            expect(result[0].count).to.equal(1);
        });
    });

    it("Delete without CSRF", () => {
        cy.query("INSERT INTO branches(branchcode, branchname) VALUES (?, ?)", [
            branchcode,
            branchname,
        ]);

        cy.visit("/cgi-bin/koha/admin/branches.pl");
        cy.get("select[name='libraries_length']").select("-1");
        cy.get("#delete_library_" + branchcode).click();

        // Remove CSRF Token
        cy.get("form[method='post']")
            .find("input[name='csrf_token']")
            .invoke("remove");

        cy.contains("Yes, delete").click();

        cy.get(".main")
            .find(".alert")
            .contains(/No CSRF token passed for POST/);

        cy.query(
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
            branchcode
        ).then(result => {
            expect(result[0].count).to.equal(1);
        });
    });

    it("Delete", () => {
        cy.query("INSERT INTO branches(branchcode, branchname) VALUES (?, ?)", [
            branchcode,
            branchname,
        ]);

        cy.visit("/cgi-bin/koha/admin/branches.pl");
        cy.get("select[name='libraries_length']").select("-1");
        cy.get("#delete_library_" + branchcode).click();

        cy.contains("Yes, delete").click();

        cy.get(".main")
            .find(".message")
            .contains(/Library deleted successfully/);

        cy.query(
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
            branchcode
        ).then(result => {
            expect(result[0].count).to.equal(0);
        });
    });
});

Return to bug 36177

Line 0 Link Here

(-)a/t/cypress/integration/Auth/csrf.ts (-1 / +175 lines)
0	-	1	import { mount } from "@cypress/vue";
		2
		3	const branchcode = "TEST_LIB";
		4	const branchname = "test_branchname";
		5
		6	function cleanup() {
		7	const sql = "DELETE FROM branches WHERE branchcode=?";
		8	cy.query(sql, branchcode);
		9	}
		10
		11	describe("CSRF", () => {
		12	beforeEach(() => {
		13	cleanup();
		14	cy.login();
		15	cy.title().should("eq", "Koha staff interface");
		16	});
		17
		18	afterEach(() => {
		19	cleanup();
		20	});
		21
		22	it("Add using POST without csrf", () => {
		23	cy.visit("/cgi-bin/koha/admin/branches.pl");
		24
		25	cy.get("#newbranch").click();
		26	cy.get("#Aform").find("input[name='csrf_token']").invoke("remove");
		27	cy.get("#branchcode").type(branchcode);
		28	cy.get("#branchname").type(branchname);
		29	cy.get("#Aform").contains("Submit").click();
		30
		31	cy.get(".main")
		32	.find(".alert")
		33	.contains(/No CSRF token passed for POST/);
		34
		35	cy.query(
		36	"SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
		37	branchcode
		38	).then(result => {
		39	expect(result[0].count).to.equal(0);
		40	});
		41	});
		42
		43	it("Add using POST with invalid csrf", () => {
		44	cy.visit("/cgi-bin/koha/admin/branches.pl");
		45
		46	cy.get("#newbranch").click();
		47	cy.get("#Aform").find("input[name='csrf_token']").invoke("val", "foo");
		48	cy.get("#branchcode").type(branchcode);
		49	cy.get("#branchname").type(branchname);
		50	cy.get("#Aform").contains("Submit").click();
		51
		52	cy.get(".main")
		53	.find(".alert")
		54	.contains(/Wrong CSRF token/);
		55
		56	cy.query(
		57	"SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
		58	branchcode
		59	).then(result => {
		60	expect(result[0].count).to.equal(0);
		61	});
		62	});
		63
		64	it("Add using GET", () => {
		65	// Trying correct op=cud-add_validate
66	cy.visit(
67	"/cgi-bin/koha/admin/branches.pl?op=cud-add_validate&branchcode=" +
68	branchcode +
69	"&branchname=" +
70	branchname,
71	{ failOnStatusCode: false }
72	);
73
74	cy.get(".main")
75	.find(".alert")
76	.contains(
77	/Programming error - op 'cud-add_validate' must not start with 'cud-' for GET/
78	);
79
80	// Trying incorrect op=add_validate
81	cy.visit(
82	"/cgi-bin/koha/admin/branches.pl?op=add_validate&branchcode=" +
83	branchcode +
84	"&branchname=" +
85	branchname
86	);
87
88	// We do not display a message
89	// We do not want Wrong CSRF token here
90	cy.get(".message").should("not.exist");
91
92	cy.query(
93	"SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
94	branchcode
95	).then(result => {
96	expect(result[0].count).to.equal(0);
97	});
98	});
99
100	it("Add", () => {
101	cy.visit("/cgi-bin/koha/admin/branches.pl");
102
103	cy.get("#newbranch").click();
104	cy.get("#branchcode").type(branchcode);
105	cy.get("#branchname").type(branchname);
106	cy.get("#Aform").contains("Submit").click();
107
108	cy.get(".main")
109	.find(".message")
110	.contains(/Library added successfully/);
111
112	cy.get("select[name='libraries_length']").select("-1");
113	cy.get("td").contains(branchcode);
114
115	cy.query(
116	"SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
117	branchcode
118	).then(result => {
119	expect(result[0].count).to.equal(1);
120	});
121	});
122
123	it("Delete without CSRF", () => {
124	cy.query("INSERT INTO branches(branchcode, branchname) VALUES (?, ?)", [
125	branchcode,
126	branchname,
127	]);
128
129	cy.visit("/cgi-bin/koha/admin/branches.pl");
130	cy.get("select[name='libraries_length']").select("-1");
131	cy.get("#delete_library_" + branchcode).click();
132
133	// Remove CSRF Token
134	cy.get("form[method='post']")
135	.find("input[name='csrf_token']")
136	.invoke("remove");
137
138	cy.contains("Yes, delete").click();
139
140	cy.get(".main")
141	.find(".alert")
142	.contains(/No CSRF token passed for POST/);
143
144	cy.query(
145	"SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
146	branchcode
147	).then(result => {
148	expect(result[0].count).to.equal(1);
149	});
150	});
151
152	it("Delete", () => {
153	cy.query("INSERT INTO branches(branchcode, branchname) VALUES (?, ?)", [
154	branchcode,
155	branchname,
156	]);
157
158	cy.visit("/cgi-bin/koha/admin/branches.pl");
159	cy.get("select[name='libraries_length']").select("-1");
160	cy.get("#delete_library_" + branchcode).click();
161
162	cy.contains("Yes, delete").click();
163
164	cy.get(".main")
165	.find(".message")
166	.contains(/Library deleted successfully/);
167
168	cy.query(
169	"SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
170	branchcode
171	).then(result => {
172	expect(result[0].count).to.equal(0);
173	});
174	});
175	});