Lines 43-57
subtest 'CSRF - Intranet' => sub {
Link Here
|
43 |
subtest 'GETting what should be POSTed should fail' => sub { |
43 |
subtest 'GETting what should be POSTed should fail' => sub { |
44 |
plan tests => 3; |
44 |
plan tests => 3; |
45 |
|
45 |
|
46 |
$t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400) |
46 |
$t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400)->content_like( |
47 |
->content_like( qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, 'Body contains correct error message' ); |
47 |
qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, |
|
|
48 |
'Body contains correct error message' |
49 |
); |
48 |
}; |
50 |
}; |
49 |
|
51 |
|
50 |
subtest 'POSTing what should be GET should fail' => sub { |
52 |
subtest 'POSTing what should be GET should fail' => sub { |
51 |
plan tests => 3; |
53 |
plan tests => 3; |
52 |
|
54 |
|
53 |
$t->post_ok('/cgi-bin/koha/mainpage.pl?op=login')->status_is(400) |
55 |
$t->post_ok('/cgi-bin/koha/mainpage.pl?op=login')->status_is(400)->content_like( |
54 |
->content_like( qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, 'Body contains correct error message' ); |
56 |
qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, |
|
|
57 |
'Body contains correct error message' |
58 |
); |
55 |
}; |
59 |
}; |
56 |
}; |
60 |
}; |
57 |
|
61 |
|
Lines 91-104
subtest 'CSRF - OPAC' => sub {
Link Here
|
91 |
subtest 'GETting what should be POSTed should fail' => sub { |
95 |
subtest 'GETting what should be POSTed should fail' => sub { |
92 |
plan tests => 3; |
96 |
plan tests => 3; |
93 |
|
97 |
|
94 |
$t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400) |
98 |
$t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400)->content_like( |
95 |
->content_like( qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, 'Body contains correct error message' ); |
99 |
qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, |
|
|
100 |
'Body contains correct error message' |
101 |
); |
96 |
}; |
102 |
}; |
97 |
|
103 |
|
98 |
subtest 'POSTing what should be GET should fail' => sub { |
104 |
subtest 'POSTing what should be GET should fail' => sub { |
99 |
plan tests => 3; |
105 |
plan tests => 3; |
100 |
|
106 |
|
101 |
$t->post_ok('/cgi-bin/koha/opac-user.pl?op=login')->status_is(400) |
107 |
$t->post_ok('/cgi-bin/koha/opac-user.pl?op=login')->status_is(400)->content_like( |
102 |
->content_like( qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, 'Body contains correct error message' ); |
108 |
qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, |
|
|
109 |
'Body contains correct error message' |
110 |
); |
103 |
}; |
111 |
}; |
104 |
}; |
112 |
}; |
105 |
- |
|
|