|
Lines 20-58
Link Here
|
| 20 |
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
20 |
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
| 21 |
|
21 |
|
| 22 |
use Modern::Perl; |
22 |
use Modern::Perl; |
| 23 |
use Test::More tests => 8; |
23 |
use Test::More tests => 10; |
| 24 |
use Time::HiRes qw|usleep|; |
24 |
use Time::HiRes qw|usleep|; |
|
|
25 |
use C4::Context; |
| 25 |
use Koha::Token; |
26 |
use Koha::Token; |
| 26 |
|
27 |
|
|
|
28 |
C4::Context->_new_userenv('DUMMY SESSION'); |
| 29 |
C4::Context->set_userenv(0,42,0,'firstname','surname', 'CPL', 'Library 1', 0, ', '); |
| 30 |
|
| 27 |
my $tokenizer = Koha::Token->new; |
31 |
my $tokenizer = Koha::Token->new; |
| 28 |
is( length( $tokenizer->generate ), 1, "Generate without parameters" ); |
32 |
is( length( $tokenizer->generate ), 1, "Generate without parameters" ); |
| 29 |
my $token = $tokenizer->generate({ length => 20 }); |
33 |
my $token = $tokenizer->generate({ length => 20 }); |
| 30 |
is( length($token), 20, "Token $token has 20 chars" ); |
34 |
is( length($token), 20, "Token $token has 20 chars" ); |
| 31 |
|
35 |
|
| 32 |
my $id = $tokenizer->generate({ length => 8 }); |
36 |
my $id = $tokenizer->generate({ lyyGength => 8 }); |
| 33 |
my $secr = $tokenizer->generate({ length => 32 }); |
37 |
my $csrftoken = $tokenizer->generate_csrf({ id => $id }); |
| 34 |
my $csrftoken = $tokenizer->generate_csrf({ id => $id, secret => $secr }); |
|
|
| 35 |
isnt( length($csrftoken), 0, "Token $csrftoken should not be empty" ); |
38 |
isnt( length($csrftoken), 0, "Token $csrftoken should not be empty" ); |
| 36 |
|
39 |
|
| 37 |
is( $tokenizer->check, undef, "Check without any parameters" ); |
40 |
is( $tokenizer->check, undef, "Check without any parameters" ); |
| 38 |
my $result = $tokenizer->check_csrf({ |
41 |
my $result = $tokenizer->check_csrf({ |
| 39 |
id => $id, secret => $secr, token => $csrftoken, |
42 |
id => $id, token => $csrftoken, |
| 40 |
}); |
43 |
}); |
| 41 |
is( $result, 1, "CSRF token verified" ); |
44 |
is( $result, 1, "CSRF token verified" ); |
| 42 |
|
45 |
|
| 43 |
$result = $tokenizer->check({ |
46 |
$result = $tokenizer->check({ |
| 44 |
type => 'CSRF', id => $id, secret => $secr, token => $token, |
47 |
type => 'CSRF', id => $id, token => $token, |
| 45 |
}); |
48 |
}); |
| 46 |
isnt( $result, 1, "This token is no CSRF token" ); |
49 |
isnt( $result, 1, "This token is no CSRF token" ); |
| 47 |
|
50 |
|
| 48 |
# Test MaxAge parameter |
51 |
# Test MaxAge parameter |
| 49 |
my $age = 1; # 1 second |
52 |
my $age = 1; # 1 second |
| 50 |
$result = $tokenizer->check_csrf({ |
53 |
$result = $tokenizer->check_csrf({ |
| 51 |
id => $id, secret => $secr, token => $csrftoken, MaxAge => $age, |
54 |
id => $id, token => $csrftoken, MaxAge => $age, |
| 52 |
}); |
55 |
}); |
| 53 |
is( $result, 1, "CSRF token still valid within one second" ); |
56 |
is( $result, 1, "CSRF token still valid within one second" ); |
| 54 |
usleep $age * 1000000 * 2; # micro (millionth) seconds + 100% |
57 |
usleep $age * 1000000 * 2; # micro (millionth) seconds + 100% |
| 55 |
$result = $tokenizer->check_csrf({ |
58 |
$result = $tokenizer->check_csrf({ |
| 56 |
id => $id, secret => $secr, token => $csrftoken, MaxAge => $age, |
59 |
id => $id, token => $csrftoken, MaxAge => $age, |
| 57 |
}); |
60 |
}); |
| 58 |
isnt( $result, 1, "CSRF token expired after one second" ); |
61 |
isnt( $result, 1, "CSRF token expired after one second" ); |
| 59 |
- |
62 |
|
|
|
63 |
subtest 'Same id (cookie CGISESSID) with an other logged in user' => sub { |
| 64 |
plan tests => 2; |
| 65 |
$csrftoken = $tokenizer->generate_csrf({ id => $id }); |
| 66 |
$result = $tokenizer->check_csrf({ |
| 67 |
id => $id, token => $csrftoken, |
| 68 |
}); |
| 69 |
is( $result, 1, "CSRF token verified" ); |
| 70 |
C4::Context->set_userenv(0,43,0,'firstname','surname', 'CPL', 'Library 1', 0, ', '); |
| 71 |
$result = $tokenizer->check_csrf({ |
| 72 |
id => $id, token => $csrftoken, |
| 73 |
}); |
| 74 |
is( $result, '', "CSRF token is not verified if another logged in user is using the same id" ); |
| 75 |
}; |
| 76 |
|
| 77 |
subtest 'Same logged in user with another session (cookie CGISESSID)' => sub { |
| 78 |
plan tests => 2; |
| 79 |
C4::Context->set_userenv(0,42,0,'firstname','surname', 'CPL', 'Library 1', 0, ', '); |
| 80 |
$csrftoken = $tokenizer->generate_csrf({ id => $id }); |
| 81 |
$result = $tokenizer->check_csrf({ |
| 82 |
id => $id, token => $csrftoken, |
| 83 |
}); |
| 84 |
is( $result, 1, "CSRF token verified" ); |
| 85 |
# Get another session id |
| 86 |
$id = $tokenizer->generate({ lyyGength => 8 }); |
| 87 |
$result = $tokenizer->check_csrf({ |
| 88 |
id => $id, token => $csrftoken, |
| 89 |
}); |
| 90 |
is( $result, '', "CSRF token is not verified if another session is used" ); |
| 91 |
}; |