Lines 8-14
use Test::Mojo;
Link Here
|
8 |
use Koha::Database; |
8 |
use Koha::Database; |
9 |
|
9 |
|
10 |
subtest 'CSRF - Intranet' => sub { |
10 |
subtest 'CSRF - Intranet' => sub { |
11 |
plan tests => 4; |
11 |
plan tests => 5; |
12 |
|
12 |
|
13 |
my $t = Test::Mojo->new('Koha::App::Intranet'); |
13 |
my $t = Test::Mojo->new('Koha::App::Intranet'); |
14 |
|
14 |
|
Lines 39-48
subtest 'CSRF - Intranet' => sub {
Link Here
|
39 |
$t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } ) |
39 |
$t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } ) |
40 |
->status_is(200)->content_like( qr/Please log in again/, 'Login failed but CSRF test passed' ); |
40 |
->status_is(200)->content_like( qr/Please log in again/, 'Login failed but CSRF test passed' ); |
41 |
}; |
41 |
}; |
|
|
42 |
|
43 |
subtest 'GETting what should be POSTed should fail' => sub { |
44 |
plan tests => 3; |
45 |
|
46 |
$t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400) |
47 |
->content_like( qr/Wrong HTTP method/, 'Body contains "Wrong HTTP method"' ); |
48 |
} |
42 |
}; |
49 |
}; |
43 |
|
50 |
|
44 |
subtest 'CSRF - OPAC' => sub { |
51 |
subtest 'CSRF - OPAC' => sub { |
45 |
plan tests => 4; |
52 |
plan tests => 5; |
46 |
|
53 |
|
47 |
my $t = Test::Mojo->new('Koha::App::Opac'); |
54 |
my $t = Test::Mojo->new('Koha::App::Opac'); |
48 |
|
55 |
|
Lines 73-76
subtest 'CSRF - OPAC' => sub {
Link Here
|
73 |
$t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } ) |
80 |
$t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } ) |
74 |
->status_is(200)->content_like( qr/Log in to your account/, 'Login failed but CSRF test passed' ); |
81 |
->status_is(200)->content_like( qr/Log in to your account/, 'Login failed but CSRF test passed' ); |
75 |
}; |
82 |
}; |
|
|
83 |
|
84 |
subtest 'GETting what should be POSTed should fail' => sub { |
85 |
plan tests => 3; |
86 |
|
87 |
$t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400) |
88 |
->content_like( qr/Wrong HTTP method/, 'Body contains "Wrong HTTP method"' ); |
89 |
} |
76 |
}; |
90 |
}; |
77 |
- |
|
|