|
Lines 26-33
subtest 'CSRF - Intranet' => sub {
Link Here
|
| 26 |
subtest 'With a wrong CSRF token' => sub { |
26 |
subtest 'With a wrong CSRF token' => sub { |
| 27 |
plan tests => 3; |
27 |
plan tests => 3; |
| 28 |
|
28 |
|
| 29 |
$t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => 'BAD', op => 'cud-login' } )->status_is(403) |
29 |
$t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => 'BAD', login_op => 'cud-login' } ) |
| 30 |
->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' ); |
30 |
->status_is(403)->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' ); |
| 31 |
}; |
31 |
}; |
| 32 |
|
32 |
|
| 33 |
subtest 'With a good CSRF token' => sub { |
33 |
subtest 'With a good CSRF token' => sub { |
|
Lines 37-51
subtest 'CSRF - Intranet' => sub {
Link Here
|
| 37 |
|
37 |
|
| 38 |
my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first; |
38 |
my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first; |
| 39 |
|
39 |
|
| 40 |
$t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } ) |
40 |
$t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, login_op => 'cud-login' } ) |
| 41 |
->status_is(200)->content_like( qr/Please log in again/, 'Login failed but CSRF test passed' ); |
41 |
->status_is(200)->content_like( qr/Please log in again/, 'Login failed but CSRF test passed' ); |
| 42 |
}; |
42 |
}; |
| 43 |
|
43 |
|
| 44 |
subtest 'GETting what should be POSTed should fail' => sub { |
44 |
subtest 'GETting what should be POSTed should fail' => sub { |
| 45 |
plan tests => 3; |
45 |
plan tests => 3; |
| 46 |
|
46 |
|
| 47 |
$t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400)->content_like( |
47 |
$t->get_ok('/cgi-bin/koha/mainpage.pl?login_op=cud-login')->status_is(400)->content_like( |
| 48 |
qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, |
48 |
qr/Incorrect use of a safe HTTP method with a `login_op` parameter/, |
| 49 |
'Body contains correct error message' |
49 |
'Body contains correct error message' |
| 50 |
); |
50 |
); |
| 51 |
}; |
51 |
}; |
|
Lines 53-60
subtest 'CSRF - Intranet' => sub {
Link Here
|
| 53 |
subtest 'POSTing what should be GET should fail' => sub { |
53 |
subtest 'POSTing what should be GET should fail' => sub { |
| 54 |
plan tests => 3; |
54 |
plan tests => 3; |
| 55 |
|
55 |
|
| 56 |
$t->post_ok('/cgi-bin/koha/mainpage.pl?op=login')->status_is(400)->content_like( |
56 |
$t->post_ok('/cgi-bin/koha/mainpage.pl?login_op=login')->status_is(400)->content_like( |
| 57 |
qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, |
57 |
qr/Incorrect use of an unsafe HTTP method with a `login_op` parameter/, |
| 58 |
'Body contains correct error message' |
58 |
'Body contains correct error message' |
| 59 |
); |
59 |
); |
| 60 |
}; |
60 |
}; |
|
Lines 78-85
subtest 'CSRF - OPAC' => sub {
Link Here
|
| 78 |
subtest 'With a wrong CSRF token' => sub { |
78 |
subtest 'With a wrong CSRF token' => sub { |
| 79 |
plan tests => 3; |
79 |
plan tests => 3; |
| 80 |
|
80 |
|
| 81 |
$t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => 'BAD', op => 'cud-login' } )->status_is(403) |
81 |
$t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => 'BAD', login_op => 'cud-login' } ) |
| 82 |
->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' ); |
82 |
->status_is(403)->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' ); |
| 83 |
}; |
83 |
}; |
| 84 |
|
84 |
|
| 85 |
subtest 'With a good CSRF token' => sub { |
85 |
subtest 'With a good CSRF token' => sub { |
|
Lines 89-103
subtest 'CSRF - OPAC' => sub {
Link Here
|
| 89 |
|
89 |
|
| 90 |
my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first; |
90 |
my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first; |
| 91 |
|
91 |
|
| 92 |
$t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } ) |
92 |
$t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, login_op => 'cud-login' } ) |
| 93 |
->status_is(200)->content_like( qr/Log in to your account/, 'Login failed but CSRF test passed' ); |
93 |
->status_is(200)->content_like( qr/Log in to your account/, 'Login failed but CSRF test passed' ); |
| 94 |
}; |
94 |
}; |
| 95 |
|
95 |
|
| 96 |
subtest 'GETting what should be POSTed should fail' => sub { |
96 |
subtest 'GETting what should be POSTed should fail' => sub { |
| 97 |
plan tests => 3; |
97 |
plan tests => 3; |
| 98 |
|
98 |
|
| 99 |
$t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400)->content_like( |
99 |
$t->get_ok('/cgi-bin/koha/opac-user.pl?login_op=cud-login')->status_is(400)->content_like( |
| 100 |
qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, |
100 |
qr/Incorrect use of a safe HTTP method with a `login_op` parameter/, |
| 101 |
'Body contains correct error message' |
101 |
'Body contains correct error message' |
| 102 |
); |
102 |
); |
| 103 |
}; |
103 |
}; |
|
Lines 105-112
subtest 'CSRF - OPAC' => sub {
Link Here
|
| 105 |
subtest 'POSTing what should be GET should fail' => sub { |
105 |
subtest 'POSTing what should be GET should fail' => sub { |
| 106 |
plan tests => 3; |
106 |
plan tests => 3; |
| 107 |
|
107 |
|
| 108 |
$t->post_ok('/cgi-bin/koha/opac-user.pl?op=login')->status_is(400)->content_like( |
108 |
$t->post_ok('/cgi-bin/koha/opac-user.pl?login_op=login')->status_is(400)->content_like( |
| 109 |
qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, |
109 |
qr/Incorrect use of an unsafe HTTP method with a `login_op` parameter/, |
| 110 |
'Body contains correct error message' |
110 |
'Body contains correct error message' |
| 111 |
); |
111 |
); |
| 112 |
}; |
112 |
}; |
| 113 |
- |
|
|