| 
      
            Line 0
          
      
      
        Link Here
      
     | 
  
          
            
              | 0 | 
              -   | 
              1 | 
              import { mount } from "@cypress/vue"; | 
            
            
               | 
               | 
              2 | 
               | 
            
            
              | 3 | 
              const branchcode = "TEST_LIB";  | 
            
            
              | 4 | 
              const branchname = "test_branchname";  | 
            
            
              | 5 | 
               | 
            
            
              | 6 | 
              function cleanup() { | 
            
            
              | 7 | 
                  const sql = "DELETE FROM branches WHERE branchcode=?";  | 
            
            
              | 8 | 
                  cy.query(sql, branchcode);  | 
            
            
              | 9 | 
              }  | 
            
            
              | 10 | 
               | 
            
            
              | 11 | 
              describe("CSRF", () => { | 
            
            
              | 12 | 
                  beforeEach(() => { | 
            
            
              | 13 | 
                      cleanup();  | 
            
            
              | 14 | 
                      cy.login();  | 
            
            
              | 15 | 
                      cy.title().should("eq", "Koha staff interface"); | 
            
            
              | 16 | 
                  });  | 
            
            
              | 17 | 
               | 
            
            
              | 18 | 
                  afterEach(() => { | 
            
            
              | 19 | 
                      cleanup();  | 
            
            
              | 20 | 
                  });  | 
            
            
              | 21 | 
               | 
            
            
              | 22 | 
                  it("Add using POST without csrf", () => { | 
            
            
              | 23 | 
                      cy.visit("/cgi-bin/koha/admin/branches.pl"); | 
            
            
              | 24 | 
               | 
            
            
              | 25 | 
                      cy.get("#newbranch").click(); | 
            
            
              | 26 | 
                      cy.get("#Aform").find("input[name='csrf_token']").invoke("remove"); | 
            
            
              | 27 | 
                      cy.get("#branchcode").type(branchcode); | 
            
            
              | 28 | 
                      cy.get("#branchname").type(branchname); | 
            
            
              | 29 | 
                      cy.get("#Aform").contains("Submit").click(); | 
            
            
              | 30 | 
               | 
            
            
              | 31 | 
                      cy.get(".main") | 
            
            
              | 32 | 
                          .find(".alert") | 
            
            
              | 33 | 
                          .contains(/No CSRF token passed for POST/);  | 
            
            
              | 34 | 
               | 
            
            
              | 35 | 
                      cy.query(  | 
            
            
              | 36 | 
                          "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",  | 
            
            
              | 37 | 
                          branchcode  | 
            
            
              | 38 | 
                      ).then(result => { | 
            
            
              | 39 | 
                          expect(result[0].count).to.equal(0);  | 
            
            
              | 40 | 
                      });  | 
            
            
              | 41 | 
                  });  | 
            
            
              | 42 | 
               | 
            
            
              | 43 | 
                  it("Add using POST with invalid csrf", () => { | 
            
            
              | 44 | 
                      cy.visit("/cgi-bin/koha/admin/branches.pl"); | 
            
            
              | 45 | 
               | 
            
            
              | 46 | 
                      cy.get("#newbranch").click(); | 
            
            
              | 47 | 
                      cy.get("#Aform").find("input[name='csrf_token']").invoke("val", "foo"); | 
            
            
              | 48 | 
                      cy.get("#branchcode").type(branchcode); | 
            
            
              | 49 | 
                      cy.get("#branchname").type(branchname); | 
            
            
              | 50 | 
                      cy.get("#Aform").contains("Submit").click(); | 
            
            
              | 51 | 
               | 
            
            
              | 52 | 
                      cy.get(".main") | 
            
            
              | 53 | 
                          .find(".alert") | 
            
            
              | 54 | 
                          .contains(/Wrong CSRF token/);  | 
            
            
              | 55 | 
               | 
            
            
              | 56 | 
                      cy.query(  | 
            
            
              | 57 | 
                          "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",  | 
            
            
              | 58 | 
                          branchcode  | 
            
            
              | 59 | 
                      ).then(result => { | 
            
            
              | 60 | 
                          expect(result[0].count).to.equal(0);  | 
            
            
              | 61 | 
                      });  | 
            
            
              | 62 | 
                  });  | 
            
            
              | 63 | 
               | 
            
            
              | 64 | 
                  it("Add using GET", () => { | 
            
            
              | 65 | 
                      // Trying correct op=cud-add_validate  | 
            
            
              | 66 | 
                      cy.visit(  | 
            
            
              | 67 | 
                          "/cgi-bin/koha/admin/branches.pl?op=cud-add_validate&branchcode=" +  | 
            
            
              | 68 | 
                              branchcode +  | 
            
            
              | 69 | 
                              "&branchname=" +  | 
            
            
              | 70 | 
                              branchname,  | 
            
            
              | 71 | 
                          { failOnStatusCode: false } | 
            
            
              | 72 | 
                      );  | 
            
            
              | 73 | 
               | 
            
            
              | 74 | 
                      cy.get(".main") | 
            
            
              | 75 | 
                          .find(".alert") | 
            
            
              | 76 | 
                          .contains(  | 
            
            
              | 77 | 
                              /Programming error - op 'cud-add_validate' must not start with 'cud-' for GET/  | 
            
            
              | 78 | 
                          );  | 
            
            
              | 79 | 
               | 
            
            
              | 80 | 
                      // Trying incorrect op=add_validate  | 
            
            
              | 81 | 
                      cy.visit(  | 
            
            
              | 82 | 
                          "/cgi-bin/koha/admin/branches.pl?op=add_validate&branchcode=" +  | 
            
            
              | 83 | 
                              branchcode +  | 
            
            
              | 84 | 
                              "&branchname=" +  | 
            
            
              | 85 | 
                              branchname  | 
            
            
              | 86 | 
                      );  | 
            
            
              | 87 | 
               | 
            
            
              | 88 | 
                      // We do not display a message  | 
            
            
              | 89 | 
                      // We do not want Wrong CSRF token here  | 
            
            
              | 90 | 
                      cy.get(".message").should("not.exist"); | 
            
            
              | 91 | 
               | 
            
            
              | 92 | 
                      cy.query(  | 
            
            
              | 93 | 
                          "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",  | 
            
            
              | 94 | 
                          branchcode  | 
            
            
              | 95 | 
                      ).then(result => { | 
            
            
              | 96 | 
                          expect(result[0].count).to.equal(0);  | 
            
            
              | 97 | 
                      });  | 
            
            
              | 98 | 
                  });  | 
            
            
              | 99 | 
               | 
            
            
              | 100 | 
                  it("Add", () => { | 
            
            
              | 101 | 
                      cy.visit("/cgi-bin/koha/admin/branches.pl"); | 
            
            
              | 102 | 
               | 
            
            
              | 103 | 
                      cy.get("#newbranch").click(); | 
            
            
              | 104 | 
                      cy.get("#branchcode").type(branchcode); | 
            
            
              | 105 | 
                      cy.get("#branchname").type(branchname); | 
            
            
              | 106 | 
                      cy.get("#Aform").contains("Submit").click(); | 
            
            
              | 107 | 
               | 
            
            
              | 108 | 
                      cy.get(".main") | 
            
            
              | 109 | 
                          .find(".message") | 
            
            
              | 110 | 
                          .contains(/Library added successfully/);  | 
            
            
              | 111 | 
               | 
            
            
              | 112 | 
                      cy.get("select[name='libraries_length']").select("-1"); | 
            
            
              | 113 | 
                      cy.get("td").contains(branchcode); | 
            
            
              | 114 | 
               | 
            
            
              | 115 | 
                      cy.query(  | 
            
            
              | 116 | 
                          "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",  | 
            
            
              | 117 | 
                          branchcode  | 
            
            
              | 118 | 
                      ).then(result => { | 
            
            
              | 119 | 
                          expect(result[0].count).to.equal(1);  | 
            
            
              | 120 | 
                      });  | 
            
            
              | 121 | 
                  });  | 
            
            
              | 122 | 
               | 
            
            
              | 123 | 
                  it("Delete without CSRF", () => { | 
            
            
              | 124 | 
                      cy.query("INSERT INTO branches(branchcode, branchname) VALUES (?, ?)", [ | 
            
            
              | 125 | 
                          branchcode,  | 
            
            
              | 126 | 
                          branchname,  | 
            
            
              | 127 | 
                      ]);  | 
            
            
              | 128 | 
               | 
            
            
              | 129 | 
                      cy.visit("/cgi-bin/koha/admin/branches.pl"); | 
            
            
              | 130 | 
                      cy.get("select[name='libraries_length']").select("-1"); | 
            
            
              | 131 | 
                      cy.get("#delete_library_" + branchcode).click(); | 
            
            
              | 132 | 
               | 
            
            
              | 133 | 
                      // Remove CSRF Token  | 
            
            
              | 134 | 
                      cy.get("form[method='post']") | 
            
            
              | 135 | 
                          .find("input[name='csrf_token']") | 
            
            
              | 136 | 
                          .invoke("remove"); | 
            
            
              | 137 | 
               | 
            
            
              | 138 | 
                      cy.contains("Yes, delete").click(); | 
            
            
              | 139 | 
               | 
            
            
              | 140 | 
                      cy.get(".main") | 
            
            
              | 141 | 
                          .find(".alert") | 
            
            
              | 142 | 
                          .contains(/No CSRF token passed for POST/);  | 
            
            
              | 143 | 
               | 
            
            
              | 144 | 
                      cy.query(  | 
            
            
              | 145 | 
                          "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",  | 
            
            
              | 146 | 
                          branchcode  | 
            
            
              | 147 | 
                      ).then(result => { | 
            
            
              | 148 | 
                          expect(result[0].count).to.equal(1);  | 
            
            
              | 149 | 
                      });  | 
            
            
              | 150 | 
                  });  | 
            
            
              | 151 | 
               | 
            
            
              | 152 | 
                  it("Delete", () => { | 
            
            
              | 153 | 
                      cy.query("INSERT INTO branches(branchcode, branchname) VALUES (?, ?)", [ | 
            
            
              | 154 | 
                          branchcode,  | 
            
            
              | 155 | 
                          branchname,  | 
            
            
              | 156 | 
                      ]);  | 
            
            
              | 157 | 
               | 
            
            
              | 158 | 
                      cy.visit("/cgi-bin/koha/admin/branches.pl"); | 
            
            
              | 159 | 
                      cy.get("select[name='libraries_length']").select("-1"); | 
            
            
              | 160 | 
                      cy.get("#delete_library_" + branchcode).click(); | 
            
            
              | 161 | 
               | 
            
            
              | 162 | 
                      cy.contains("Yes, delete").click(); | 
            
            
              | 163 | 
               | 
            
            
              | 164 | 
                      cy.get(".main") | 
            
            
              | 165 | 
                          .find(".message") | 
            
            
              | 166 | 
                          .contains(/Library deleted successfully/);  | 
            
            
              | 167 | 
               | 
            
            
              | 168 | 
                      cy.query(  | 
            
            
              | 169 | 
                          "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",  | 
            
            
              | 170 | 
                          branchcode  | 
            
            
              | 171 | 
                      ).then(result => { | 
            
            
              | 172 | 
                          expect(result[0].count).to.equal(0);  | 
            
            
              | 173 | 
                      });  | 
            
            
              | 174 | 
                  });  | 
            
            
              | 175 | 
              });  |