|
Lines 19-31
use Modern::Perl;
Link Here
|
| 19 |
|
19 |
|
| 20 |
use CGI; |
20 |
use CGI; |
| 21 |
|
21 |
|
| 22 |
use Test::More tests => 7; |
22 |
use Test::More tests => 8; |
| 23 |
use Test::Deep; |
23 |
use Test::Deep; |
| 24 |
use Test::MockModule; |
24 |
use Test::MockModule; |
| 25 |
use Test::Warn; |
25 |
use Test::Warn; |
|
|
26 |
use File::Spec; |
| 27 |
use File::Temp qw/tempfile/; |
| 26 |
|
28 |
|
| 27 |
use t::lib::Mocks; |
29 |
use t::lib::Mocks; |
| 28 |
|
30 |
|
|
|
31 |
use C4::Auth qw//; |
| 32 |
|
| 29 |
BEGIN { |
33 |
BEGIN { |
| 30 |
use_ok( 'C4::Templates' ); |
34 |
use_ok( 'C4::Templates' ); |
| 31 |
can_ok( 'C4::Templates', |
35 |
can_ok( 'C4::Templates', |
|
Lines 102-114
subtest 'Testing gettemplate/badtemplatecheck' => sub {
Link Here
|
| 102 |
|
106 |
|
| 103 |
my $cgi = CGI->new; |
107 |
my $cgi = CGI->new; |
| 104 |
my $template; |
108 |
my $template; |
| 105 |
warning_like { eval { $template = C4::Templates::gettemplate( '/etc/passwd', 'opac', $cgi, 1 ) }; warn $@ if $@; } qr/bad template/, 'Bad template check'; |
109 |
warning_like { eval { $template = C4::Templates::gettemplate( '/etc/passwd', 'opac', $cgi ) }; warn $@ if $@; } qr/bad template/, 'Bad template check'; |
| 106 |
is( $template ? $template->output: '', '', 'Check output' ); |
110 |
is( $template ? $template->output: '', '', 'Check output' ); |
| 107 |
|
111 |
|
| 108 |
# Test a few more bad paths to gettemplate triggering badtemplatecheck |
112 |
# Test a few more bad paths to gettemplate triggering badtemplatecheck |
| 109 |
warning_like { eval { C4::Templates::gettemplate( '../topsecret.tt', 'opac', $cgi, 1 ) }; warn $@ if $@; } qr/bad template/, 'No safe chars'; |
113 |
warning_like { eval { C4::Templates::gettemplate( '../topsecret.tt', 'opac', $cgi ) }; warn $@ if $@; } qr/bad template/, 'No safe chars'; |
| 110 |
warning_like { eval { C4::Templates::gettemplate( '/noaccess/topsecret.tt', 'opac', $cgi, 1 ) }; warn $@ if $@; } qr/bad template/, 'Directory not allowed'; |
114 |
warning_like { eval { C4::Templates::gettemplate( '/noaccess/topsecret.tt', 'opac', $cgi ) }; warn $@ if $@; } qr/bad template/, 'Directory not allowed'; |
| 111 |
warning_like { eval { C4::Templates::gettemplate( C4::Context->config('intrahtdocs') . '2/prog/en/modules/about.tt', 'intranet', $cgi, 1 ) }; warn $@ if $@; } qr/bad template/, 'Directory not allowed too'; |
115 |
warning_like { eval { C4::Templates::gettemplate( C4::Context->config('intrahtdocs') . '2/prog/en/modules/about.tt', 'intranet', $cgi ) }; warn $@ if $@; } qr/bad template/, 'Directory not allowed too'; |
| 112 |
|
116 |
|
| 113 |
# Allow templates from /tmp |
117 |
# Allow templates from /tmp |
| 114 |
t::lib::Mocks::mock_config( 'pluginsdir', [ '/tmp' ] ); |
118 |
t::lib::Mocks::mock_config( 'pluginsdir', [ '/tmp' ] ); |
|
Lines 117-119
subtest 'Testing gettemplate/badtemplatecheck' => sub {
Link Here
|
| 117 |
warning_like { eval { C4::Templates::badtemplatecheck( '/tmp/about.tmpl' ) }; warn $@ if $@; } qr/bad template/, 'Warn on bad extension'; |
121 |
warning_like { eval { C4::Templates::badtemplatecheck( '/tmp/about.tmpl' ) }; warn $@ if $@; } qr/bad template/, 'Warn on bad extension'; |
| 118 |
}; |
122 |
}; |
| 119 |
|
123 |
|
| 120 |
- |
124 |
subtest "Absolute path change in _get_template_file" => sub { |
|
|
125 |
plan tests => 1; |
| 126 |
|
| 127 |
# We create a simple template in /tmp. |
| 128 |
# We simulate an anonymous OPAC session; the OPACBaseURL template variable |
| 129 |
# should be filled by get_template_and_user. |
| 130 |
t::lib::Mocks::mock_config( 'pluginsdir', [ File::Spec->tmpdir ] ); |
| 131 |
t::lib::Mocks::mock_preference( 'OPACBaseURL', 'without any doubt' ); |
| 132 |
my ( $fh, $fn ) = tempfile( SUFFIX => '.tt', UNLINK => 1 ); |
| 133 |
print $fh q|I am a [% quality %] template [% OPACBaseURL %]|; |
| 134 |
close $fh; |
| 135 |
my ( $template, $login, $cookie ) = C4::Auth::get_template_and_user({ |
| 136 |
template_name => $fn, |
| 137 |
query => CGI::new, |
| 138 |
type => "opac", |
| 139 |
authnotrequired => 1, |
| 140 |
}); |
| 141 |
$template->param( quality => 'good-for-nothing' ); |
| 142 |
like( $template->output, qr/a good.+template.+doubt/, 'Testing a template with an absolute path' ); |
| 143 |
}; |