|
Lines 17-23
Link Here
|
| 17 |
|
17 |
|
| 18 |
use Modern::Perl; |
18 |
use Modern::Perl; |
| 19 |
|
19 |
|
| 20 |
use Test::More tests => 2; |
20 |
use Test::More tests => 3; |
| 21 |
use Test::Mojo; |
21 |
use Test::Mojo; |
| 22 |
|
22 |
|
| 23 |
use t::lib::TestBuilder; |
23 |
use t::lib::TestBuilder; |
|
Lines 148-150
subtest 'x-koha-embed tests' => sub {
Link Here
|
| 148 |
|
148 |
|
| 149 |
$schema->storage->txn_rollback; |
149 |
$schema->storage->txn_rollback; |
| 150 |
}; |
150 |
}; |
| 151 |
- |
151 |
|
|
|
152 |
subtest 'SQL injection in "query" handling' => sub { |
| 153 |
|
| 154 |
plan tests => 2; |
| 155 |
|
| 156 |
$schema->storage->txn_begin; |
| 157 |
|
| 158 |
my $librarian = $builder->build_object( |
| 159 |
{ |
| 160 |
class => 'Koha::Patrons', |
| 161 |
value => { flags => 1 } # superlibrarian |
| 162 |
} |
| 163 |
); |
| 164 |
my $password = 'thePassword123'; |
| 165 |
$librarian->set_password( { password => $password, skip_validation => 1 } ); |
| 166 |
my $userid = $librarian->userid; |
| 167 |
|
| 168 |
my $patron_id = $builder->build_object( { class => 'Koha::Patrons' } )->id; |
| 169 |
|
| 170 |
my $q = |
| 171 |
"[{\"-and\":[[{\"me.patron_id\":{\"like(IF(ASCII(SUBSTRING((SELECT version()),1,1))=ASCII('1'),SLEEP(1/100000),0))or\":\"\%a\%\"}}]]}]"; |
| 172 |
|
| 173 |
$t->get_ok("//$userid:$password@/api/v1/patrons?q=$q") |
| 174 |
->status_is( 400, 'Attempt to inject SQL through operators is rejected' ); |
| 175 |
|
| 176 |
$schema->storage->txn_rollback; |
| 177 |
}; |