Attachment #40447 for bug #14408

View | Details | Raw Unified | Return to bug 14408
Collapse All | Expand All

Lines 157-164 sub get_template_and_user { Link Here

(-)a/C4/Auth.pm (-2 / +2 lines)
157	my ( $user, $cookie, $sessionID, $flags );	157	my ( $user, $cookie, $sessionID, $flags );
158		158
159	C4::Context->interface( $in->{type} );	159	C4::Context->interface( $in->{type} );
160		160
161	my $safe_chars = 'a-zA-Z_\-\/';	161	my $safe_chars = 'a-zA-Z0-9_\-\/';
162	die "bad template path" unless $in->{'template_name'} =~ m/^[$safe_chars]+.tt?$/ig; #sanitize input	162	die "bad template path" unless $in->{'template_name'} =~ m/^[$safe_chars]+.tt?$/ig; #sanitize input
163		163
164	$in->{'authnotrequired'} \|\|= 0;	164	$in->{'authnotrequired'} \|\|= 0;




use CGI qw ( -utf8 );
use Test::MockModule;
use List::MoreUtils qw/all any none/;
use Test::More tests => 12;
use Test::Warn;
use C4::Members;
use Koha::AuthUtils qw/hash_password/;

        };
        like ( $@, qr(^bad template path), 'The file $template_name should not be accessible' );
    }
    ( $template, $loggedinuser, $cookies ) = get_template_and_user(
        {
            template_name   => 'errors/500.tt',
            query           => $query,
            type            => "intranet",
            authnotrequired => 1,
            flagsrequired   => { catalogue => 1 },
        }
    );
    my $file_exists = ( -f $template->{filename} ) ? 1 : 0;
    is ( $file_exists, 1, 'The file errors/500.tt should be accessible (contains integers)' );
}

# Check that there is always an OPACBaseURL set.
- 

Return to bug 14408

Lines 8-14 use Modern::Perl; Link Here

(-)a/t/db_dependent/Auth.t (-2 / +12 lines)
8	use CGI qw ( -utf8 );	8	use CGI qw ( -utf8 );
9	use Test::MockModule;	9	use Test::MockModule;
10	use List::MoreUtils qw/all any none/;	10	use List::MoreUtils qw/all any none/;
11	use Test::More tests => 11;	11	use Test::More tests => 12;
12	use Test::Warn;	12	use Test::Warn;
13	use C4::Members;	13	use C4::Members;
14	use Koha::AuthUtils qw/hash_password/;	14	use Koha::AuthUtils qw/hash_password/;
Lines 127-132 $dbh->{RaiseError} = 1; Link Here
127	};	127	};
128	like ( $@, qr(^bad template path), 'The file $template_name should not be accessible' );	128	like ( $@, qr(^bad template path), 'The file $template_name should not be accessible' );
129	}	129	}
		130	( $template, $loggedinuser, $cookies ) = get_template_and_user(
		131	{
		132	template_name => 'errors/500.tt',
		133	query => $query,
		134	type => "intranet",
		135	authnotrequired => 1,
		136	flagsrequired => { catalogue => 1 },
		137	}
		138	);
		139	my $file_exists = ( -f $template->{filename} ) ? 1 : 0;
		140	is ( $file_exists, 1, 'The file errors/500.tt should be accessible (contains integers)' );
130	}	141	}
131		142
132	# Check that there is always an OPACBaseURL set.	143	# Check that there is always an OPACBaseURL set.
133	-