| 
      
            Lines 43-57
          subtest 'CSRF - Intranet' => sub {
      
      
        Link Here
      
     | 
  
        
          | 43 | 
              subtest 'GETting what should be POSTed should fail' => sub { | 
          43 | 
              subtest 'GETting what should be POSTed should fail' => sub { | 
        
        
          | 44 | 
                  plan tests => 3;  | 
          44 | 
                  plan tests => 3;  | 
        
        
          | 45 | 
           | 
          45 | 
           | 
        
          
            
              | 46 | 
                      $t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400) | 
              46 | 
                      $t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400)->content_like( | 
            
            
              | 47 | 
                          ->content_like( qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, 'Body contains correct error message' );  | 
              47 | 
                          qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/,  | 
            
            
               | 
               | 
              48 | 
                          'Body contains correct error message'  | 
            
            
              | 49 | 
                      );  | 
            
        
          | 48 | 
              };  | 
          50 | 
              };  | 
        
        
          | 49 | 
           | 
          51 | 
           | 
        
        
          | 50 | 
              subtest 'POSTing what should be GET should fail' => sub { | 
          52 | 
              subtest 'POSTing what should be GET should fail' => sub { | 
        
        
          | 51 | 
                  plan tests => 3;  | 
          53 | 
                  plan tests => 3;  | 
        
        
          | 52 | 
           | 
          54 | 
           | 
        
          
            
              | 53 | 
                      $t->post_ok('/cgi-bin/koha/mainpage.pl?op=login')->status_is(400) | 
              55 | 
                      $t->post_ok('/cgi-bin/koha/mainpage.pl?op=login')->status_is(400)->content_like( | 
            
            
              | 54 | 
                          ->content_like( qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, 'Body contains correct error message' );  | 
              56 | 
                          qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/,  | 
            
            
               | 
               | 
              57 | 
                          'Body contains correct error message'  | 
            
            
              | 58 | 
                      );  | 
            
        
          | 55 | 
              };  | 
          59 | 
              };  | 
        
        
          | 56 | 
          };  | 
          60 | 
          };  | 
        
        
          | 57 | 
           | 
          61 | 
           | 
        
  
    | 
      
            Lines 91-104
          subtest 'CSRF - OPAC' => sub {
      
      
        Link Here
      
     | 
  
        
          | 91 | 
              subtest 'GETting what should be POSTed should fail' => sub { | 
          95 | 
              subtest 'GETting what should be POSTed should fail' => sub { | 
        
        
          | 92 | 
                  plan tests => 3;  | 
          96 | 
                  plan tests => 3;  | 
        
        
          | 93 | 
           | 
          97 | 
           | 
        
          
            
              | 94 | 
                      $t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400) | 
              98 | 
                      $t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400)->content_like( | 
            
            
              | 95 | 
                          ->content_like( qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, 'Body contains correct error message' );  | 
              99 | 
                          qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/,  | 
            
            
               | 
               | 
              100 | 
                          'Body contains correct error message'  | 
            
            
              | 101 | 
                      );  | 
            
        
          | 96 | 
              };  | 
          102 | 
              };  | 
        
        
          | 97 | 
           | 
          103 | 
           | 
        
        
          | 98 | 
              subtest 'POSTing what should be GET should fail' => sub { | 
          104 | 
              subtest 'POSTing what should be GET should fail' => sub { | 
        
        
          | 99 | 
                  plan tests => 3;  | 
          105 | 
                  plan tests => 3;  | 
        
        
          | 100 | 
           | 
          106 | 
           | 
        
          
            
              | 101 | 
                      $t->post_ok('/cgi-bin/koha/opac-user.pl?op=login')->status_is(400) | 
              107 | 
                      $t->post_ok('/cgi-bin/koha/opac-user.pl?op=login')->status_is(400)->content_like( | 
            
            
              | 102 | 
                          ->content_like( qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, 'Body contains correct error message' );  | 
              108 | 
                          qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/,  | 
            
            
               | 
               | 
              109 | 
                          'Body contains correct error message'  | 
            
            
              | 110 | 
                      );  | 
            
        
          | 103 | 
              };  | 
          111 | 
              };  | 
        
        
          | 104 | 
          };  | 
          112 | 
          };  | 
        
            
              | 105 | 
              -   | 
               | 
               |