View | Details | Raw Unified | Return to bug 38365
Collapse All | Expand All

(-)a/Koha/REST/V1/CSPReports.pm (+10 lines)
Lines 21-26 use Modern::Perl; Link Here
21
21
22
use Mojo::Base 'Mojolicious::Controller';
22
use Mojo::Base 'Mojolicious::Controller';
23
23
24
use Koha::ContentSecurityPolicy;
24
use Koha::Logger;
25
use Koha::Logger;
25
26
26
=head1 NAME
27
=head1 NAME
Lines 46-51 is violated. This endpoint logs those reports for administrator review. Link Here
46
sub add {
47
sub add {
47
    my $c = shift->openapi->valid_input or return;
48
    my $c = shift->openapi->valid_input or return;
48
49
50
    # Return HTTP 204 if CSP is disabled.
51
    # We could return 4xx, but clients do not need to be aware of the configured
52
    # status of this endpoint
53
    my $csp = Koha::ContentSecurityPolicy->new;
54
    return $c->render(
55
        status  => 204,
56
        openapi => undef
57
    ) if !$csp->is_enabled( { interface => 'opac' } ) && !$csp->is_enabled( { interface => 'intranet' } );
58
49
    my $logger = Koha::Logger->get( { interface => 'csp' } );
59
    my $logger = Koha::Logger->get( { interface => 'csp' } );
50
60
51
    my @reports           = ();
61
    my @reports           = ();
(-)a/t/db_dependent/api/v1/public/csp_reports.t (-3 / +30 lines)
Lines 42-48 subtest 'add() tests' => sub { Link Here
42
42
43
    foreach my $csp_report_type ( 'report-uri', 'report-to' ) {
43
    foreach my $csp_report_type ( 'report-uri', 'report-to' ) {
44
        subtest "Test $csp_report_type" => sub {
44
        subtest "Test $csp_report_type" => sub {
45
            plan tests => 15;
45
            plan tests => 17;
46
            my $content_type = $csp_report_type eq 'report-to' ? 'application/csp-report' : 'application/reports+json';
46
            my $content_type = $csp_report_type eq 'report-to' ? 'application/csp-report' : 'application/reports+json';
47
47
48
            # Test with standard CSP report-uri format
48
            # Test with standard CSP report-uri format
Lines 104-109 subtest 'add() tests' => sub { Link Here
104
            $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report )
104
            $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report )
105
                ->status_is( 204, 'CSP report accepted' );
105
                ->status_is( 204, 'CSP report accepted' );
106
106
107
            # Correct status code should be returned if the feature is disabled
108
            t::lib::Mocks::mock_config(
109
                'content_security_policy',
110
                { opac => { csp_mode => '' } }
111
            );
112
            $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report )
113
                ->status_is( 204, 'CSP report accepted' );
114
            t::lib::Mocks::mock_config(
115
                'content_security_policy',
116
                { opac => { csp_mode => 'enabled' } }
117
            );
118
107
            # Test with application/json content type (also valid)
119
            # Test with application/json content type (also valid)
108
            $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report )
120
            $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report )
109
                ->status_is( 204, 'CSP report accepted with application/json content type' );
121
                ->status_is( 204, 'CSP report accepted with application/json content type' );
Lines 123-129 subtest 'add() tests' => sub { Link Here
123
                ->status_is( 204, 'Minimal CSP report accepted' );
135
                ->status_is( 204, 'Minimal CSP report accepted' );
124
136
125
            subtest 'make sure log entries are being written' => sub {
137
            subtest 'make sure log entries are being written' => sub {
126
                plan tests => 18;
138
                plan tests => 22;
127
139
128
                my $log4perl_conf_file = C4::Context->config('intranetdir') . '/etc/log4perl.conf';
140
                my $log4perl_conf_file = C4::Context->config('intranetdir') . '/etc/log4perl.conf';
129
                open my $fh, '<:encoding(UTF-8)', $log4perl_conf_file or do {
141
                open my $fh, '<:encoding(UTF-8)', $log4perl_conf_file or do {
Lines 159-164 subtest 'add() tests' => sub { Link Here
159
                is( $appender->buffer,      '', 'Nothing in log buffer yet' );
171
                is( $appender->buffer,      '', 'Nothing in log buffer yet' );
160
                is( $appenderplack->buffer, '', 'Nothing in plack log buffer yet' );
172
                is( $appenderplack->buffer, '', 'Nothing in plack log buffer yet' );
161
173
174
                # Correct status code should be returned if the feature is disabled
175
                t::lib::Mocks::mock_config(
176
                    'content_security_policy',
177
                    { opac => { csp_mode => '' } }
178
                );
179
                $t->post_ok(
180
                    '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report )
181
                    ->status_is( 204, 'CSP report accepted' );
182
183
                is( $appender->buffer,      '', 'Nothing in log buffer yet, because the feature is disabled' );
184
                is( $appenderplack->buffer, '', 'Nothing in plack log buffer yet, because the feature is disabled' );
185
                t::lib::Mocks::mock_config(
186
                    'content_security_policy',
187
                    { opac => { csp_mode => 'enabled' } }
188
                );
189
162
                $t->post_ok(
190
                $t->post_ok(
163
                    '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report )
191
                    '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report )
164
                    ->status_is( 204, 'CSP report accepted' );
192
                    ->status_is( 204, 'CSP report accepted' );
165
- 

Return to bug 38365