|
Lines 27-33
subtest 'CSRF - Intranet' => sub {
Link Here
|
| 27 |
subtest 'With a wrong CSRF token' => sub { |
27 |
subtest 'With a wrong CSRF token' => sub { |
| 28 |
plan tests => 3; |
28 |
plan tests => 3; |
| 29 |
|
29 |
|
| 30 |
$t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => 'BAD', op => 'cud-login' } ) |
30 |
$t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => 'BAD', login_op => 'cud-login' } ) |
| 31 |
->status_is(403) |
31 |
->status_is(403) |
| 32 |
->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' ); |
32 |
->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' ); |
| 33 |
}; |
33 |
}; |
|
Lines 39-45
subtest 'CSRF - Intranet' => sub {
Link Here
|
| 39 |
|
39 |
|
| 40 |
my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first; |
40 |
my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first; |
| 41 |
|
41 |
|
| 42 |
$t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } ) |
42 |
$t->post_ok( '/cgi-bin/koha/mainpage.pl', form => { csrf_token => $csrf_token, login_op => 'cud-login' } ) |
| 43 |
->status_is(200) |
43 |
->status_is(200) |
| 44 |
->content_like( qr/Please log in again/, 'Login failed but CSRF test passed' ); |
44 |
->content_like( qr/Please log in again/, 'Login failed but CSRF test passed' ); |
| 45 |
}; |
45 |
}; |
|
Lines 47-54
subtest 'CSRF - Intranet' => sub {
Link Here
|
| 47 |
subtest 'GETting what should be POSTed should fail' => sub { |
47 |
subtest 'GETting what should be POSTed should fail' => sub { |
| 48 |
plan tests => 3; |
48 |
plan tests => 3; |
| 49 |
|
49 |
|
| 50 |
$t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400)->content_like( |
50 |
$t->get_ok('/cgi-bin/koha/mainpage.pl?login_op=cud-login')->status_is(400)->content_like( |
| 51 |
qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, |
51 |
qr/Incorrect use of a safe HTTP method with a `login_op` parameter/, |
| 52 |
'Body contains correct error message' |
52 |
'Body contains correct error message' |
| 53 |
); |
53 |
); |
| 54 |
}; |
54 |
}; |
|
Lines 56-63
subtest 'CSRF - Intranet' => sub {
Link Here
|
| 56 |
subtest 'POSTing what should be GET should fail' => sub { |
56 |
subtest 'POSTing what should be GET should fail' => sub { |
| 57 |
plan tests => 3; |
57 |
plan tests => 3; |
| 58 |
|
58 |
|
| 59 |
$t->post_ok('/cgi-bin/koha/mainpage.pl?op=login')->status_is(400)->content_like( |
59 |
$t->post_ok('/cgi-bin/koha/mainpage.pl?login_op=login')->status_is(400)->content_like( |
| 60 |
qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, |
60 |
qr/Incorrect use of an unsafe HTTP method with a `login_op` parameter/, |
| 61 |
'Body contains correct error message' |
61 |
'Body contains correct error message' |
| 62 |
); |
62 |
); |
| 63 |
}; |
63 |
}; |
|
Lines 82-88
subtest 'CSRF - OPAC' => sub {
Link Here
|
| 82 |
subtest 'With a wrong CSRF token' => sub { |
82 |
subtest 'With a wrong CSRF token' => sub { |
| 83 |
plan tests => 3; |
83 |
plan tests => 3; |
| 84 |
|
84 |
|
| 85 |
$t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => 'BAD', op => 'cud-login' } ) |
85 |
$t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => 'BAD', login_op => 'cud-login' } ) |
| 86 |
->status_is(403) |
86 |
->status_is(403) |
| 87 |
->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' ); |
87 |
->content_like( qr/Wrong CSRF token/, 'Body contains "Wrong CSRF token"' ); |
| 88 |
}; |
88 |
}; |
|
Lines 94-100
subtest 'CSRF - OPAC' => sub {
Link Here
|
| 94 |
|
94 |
|
| 95 |
my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first; |
95 |
my $csrf_token = $t->tx->res->dom('input[name="csrf_token"]')->map( attr => 'value' )->first; |
| 96 |
|
96 |
|
| 97 |
$t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, op => 'cud-login' } ) |
97 |
$t->post_ok( '/cgi-bin/koha/opac-user.pl', form => { csrf_token => $csrf_token, login_op => 'cud-login' } ) |
| 98 |
->status_is(200) |
98 |
->status_is(200) |
| 99 |
->content_like( qr/Log in to your account/, 'Login failed but CSRF test passed' ); |
99 |
->content_like( qr/Log in to your account/, 'Login failed but CSRF test passed' ); |
| 100 |
}; |
100 |
}; |
|
Lines 102-109
subtest 'CSRF - OPAC' => sub {
Link Here
|
| 102 |
subtest 'GETting what should be POSTed should fail' => sub { |
102 |
subtest 'GETting what should be POSTed should fail' => sub { |
| 103 |
plan tests => 3; |
103 |
plan tests => 3; |
| 104 |
|
104 |
|
| 105 |
$t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400)->content_like( |
105 |
$t->get_ok('/cgi-bin/koha/opac-user.pl?login_op=cud-login')->status_is(400)->content_like( |
| 106 |
qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"/, |
106 |
qr/Incorrect use of a safe HTTP method with a `login_op` parameter/, |
| 107 |
'Body contains correct error message' |
107 |
'Body contains correct error message' |
| 108 |
); |
108 |
); |
| 109 |
}; |
109 |
}; |
|
Lines 111-118
subtest 'CSRF - OPAC' => sub {
Link Here
|
| 111 |
subtest 'POSTing what should be GET should fail' => sub { |
111 |
subtest 'POSTing what should be GET should fail' => sub { |
| 112 |
plan tests => 3; |
112 |
plan tests => 3; |
| 113 |
|
113 |
|
| 114 |
$t->post_ok('/cgi-bin/koha/opac-user.pl?op=login')->status_is(400)->content_like( |
114 |
$t->post_ok('/cgi-bin/koha/opac-user.pl?login_op=login')->status_is(400)->content_like( |
| 115 |
qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"/, |
115 |
qr/Incorrect use of an unsafe HTTP method with a `login_op` parameter/, |
| 116 |
'Body contains correct error message' |
116 |
'Body contains correct error message' |
| 117 |
); |
117 |
); |
| 118 |
}; |
118 |
}; |
| 119 |
- |
|
|