|
Lines 43-57
subtest 'CSRF - Intranet' => sub {
Link Here
|
| 43 |
subtest 'GETting what should be POSTed should fail' => sub { |
43 |
subtest 'GETting what should be POSTed should fail' => sub { |
| 44 |
plan tests => 3; |
44 |
plan tests => 3; |
| 45 |
|
45 |
|
| 46 |
$t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400) |
46 |
$t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400)->content_like( |
| 47 |
->content_like( qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, 'Body contains correct error message' ); |
47 |
qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, |
|
|
48 |
'Body contains correct error message' |
| 49 |
); |
| 48 |
}; |
50 |
}; |
| 49 |
|
51 |
|
| 50 |
subtest 'POSTing what should be GET should fail' => sub { |
52 |
subtest 'POSTing what should be GET should fail' => sub { |
| 51 |
plan tests => 3; |
53 |
plan tests => 3; |
| 52 |
|
54 |
|
| 53 |
$t->post_ok('/cgi-bin/koha/mainpage.pl?op=login')->status_is(400) |
55 |
$t->post_ok('/cgi-bin/koha/mainpage.pl?op=login')->status_is(400)->content_like( |
| 54 |
->content_like( qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, 'Body contains correct error message' ); |
56 |
qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, |
|
|
57 |
'Body contains correct error message' |
| 58 |
); |
| 55 |
}; |
59 |
}; |
| 56 |
}; |
60 |
}; |
| 57 |
|
61 |
|
|
Lines 91-104
subtest 'CSRF - OPAC' => sub {
Link Here
|
| 91 |
subtest 'GETting what should be POSTed should fail' => sub { |
95 |
subtest 'GETting what should be POSTed should fail' => sub { |
| 92 |
plan tests => 3; |
96 |
plan tests => 3; |
| 93 |
|
97 |
|
| 94 |
$t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400) |
98 |
$t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400)->content_like( |
| 95 |
->content_like( qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, 'Body contains correct error message' ); |
99 |
qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, |
|
|
100 |
'Body contains correct error message' |
| 101 |
); |
| 96 |
}; |
102 |
}; |
| 97 |
|
103 |
|
| 98 |
subtest 'POSTing what should be GET should fail' => sub { |
104 |
subtest 'POSTing what should be GET should fail' => sub { |
| 99 |
plan tests => 3; |
105 |
plan tests => 3; |
| 100 |
|
106 |
|
| 101 |
$t->post_ok('/cgi-bin/koha/opac-user.pl?op=login')->status_is(400) |
107 |
$t->post_ok('/cgi-bin/koha/opac-user.pl?op=login')->status_is(400)->content_like( |
| 102 |
->content_like( qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, 'Body contains correct error message' ); |
108 |
qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, |
|
|
109 |
'Body contains correct error message' |
| 110 |
); |
| 103 |
}; |
111 |
}; |
| 104 |
}; |
112 |
}; |
| 105 |
- |
|
|