|
Lines 8-14
use Test::Mojo;
Link Here
|
| 8 |
use Koha::Database; |
8 |
use Koha::Database; |
| 9 |
|
9 |
|
| 10 |
subtest 'CSRF - Intranet' => sub { |
10 |
subtest 'CSRF - Intranet' => sub { |
| 11 |
plan tests => 4; |
11 |
plan tests => 5; |
| 12 |
|
12 |
|
| 13 |
my $t = Test::Mojo->new('Koha::App::Intranet'); |
13 |
my $t = Test::Mojo->new('Koha::App::Intranet'); |
| 14 |
|
14 |
|
|
Lines 39-48
subtest 'CSRF - Intranet' => sub {
Link Here
|
| 39 |
$t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } ) |
39 |
$t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } ) |
| 40 |
->status_is(200)->content_like( qr/Please log in again/, 'Login failed but CSRF test passed' ); |
40 |
->status_is(200)->content_like( qr/Please log in again/, 'Login failed but CSRF test passed' ); |
| 41 |
}; |
41 |
}; |
|
|
42 |
|
| 43 |
subtest 'GETting what should be POSTed should fail' => sub { |
| 44 |
plan tests => 3; |
| 45 |
|
| 46 |
$t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400) |
| 47 |
->content_like( qr/Wrong HTTP method/, 'Body contains "Wrong HTTP method"' ); |
| 48 |
} |
| 42 |
}; |
49 |
}; |
| 43 |
|
50 |
|
| 44 |
subtest 'CSRF - OPAC' => sub { |
51 |
subtest 'CSRF - OPAC' => sub { |
| 45 |
plan tests => 4; |
52 |
plan tests => 5; |
| 46 |
|
53 |
|
| 47 |
my $t = Test::Mojo->new('Koha::App::Opac'); |
54 |
my $t = Test::Mojo->new('Koha::App::Opac'); |
| 48 |
|
55 |
|
|
Lines 73-76
subtest 'CSRF - OPAC' => sub {
Link Here
|
| 73 |
$t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } ) |
80 |
$t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } ) |
| 74 |
->status_is(200)->content_like( qr/Log in to your account/, 'Login failed but CSRF test passed' ); |
81 |
->status_is(200)->content_like( qr/Log in to your account/, 'Login failed but CSRF test passed' ); |
| 75 |
}; |
82 |
}; |
|
|
83 |
|
| 84 |
subtest 'GETting what should be POSTed should fail' => sub { |
| 85 |
plan tests => 3; |
| 86 |
|
| 87 |
$t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400) |
| 88 |
->content_like( qr/Wrong HTTP method/, 'Body contains "Wrong HTTP method"' ); |
| 89 |
} |
| 76 |
}; |
90 |
}; |
| 77 |
- |
|
|