|
Lines 26-31
use C4::Context;
Link Here
|
| 26 |
use C4::Biblio; |
26 |
use C4::Biblio; |
| 27 |
|
27 |
|
| 28 |
use Koha::Database; |
28 |
use Koha::Database; |
|
|
29 |
use Koha::Caches; |
| 29 |
|
30 |
|
| 30 |
use MARC::Field; |
31 |
use MARC::Field; |
| 31 |
|
32 |
|
|
Lines 94-116
subtest 'open redirection vulnerabilities in tracklinks' => sub {
Link Here
|
| 94 |
'/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&itemnumber=' |
95 |
'/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&itemnumber=' |
| 95 |
. $itemnumber1; |
96 |
. $itemnumber1; |
| 96 |
|
97 |
|
|
|
98 |
Koha::Caches->flush_L1_caches; |
| 97 |
# Don't Track |
99 |
# Don't Track |
| 98 |
t::lib::Mocks::mock_preference( 'TrackClicks', '' ); |
100 |
C4::Context->set_preference( 'TrackClicks', '' ); |
| 99 |
$t->get_ok( $opac . $no_biblionumber ) |
101 |
$t->get_ok( $opac . $no_biblionumber ) |
| 100 |
->status_is( 404, "404 for no biblionumber" ); |
102 |
->status_is( 404, "404 for no biblionumber" ); |
| 101 |
$t->get_ok( $opac . $bad_biblionumber1 ) |
103 |
$t->get_ok( $opac . $bad_biblionumber1 ) |
| 102 |
->status_is( 404, "404 for biblionumber containing no URI" ); |
104 |
->status_is( 404, "404 for biblionumber containing no URI - pref off" ); |
| 103 |
$t->get_ok( $opac . $bad_biblionumber2 ) |
105 |
$t->get_ok( $opac . $bad_biblionumber2 ) |
| 104 |
->status_is( 404, "404 for biblionumber containing different URI" ); |
106 |
->status_is( 404, "404 for biblionumber containing different URI - pref off" ); |
| 105 |
$t->get_ok( $opac . $good_biblionumber ) |
107 |
$t->get_ok( $opac . $good_biblionumber ) |
| 106 |
->status_is( 302, "302 for biblionumber with matching URI" ); |
108 |
->status_is( 404, "404 for biblionumber with matching URI - pref off" ); |
| 107 |
$t->get_ok( $opac . $bad_itemnumber ) |
109 |
$t->get_ok( $opac . $bad_itemnumber ) |
| 108 |
->status_is( 404, "404 for itemnumber containing different URI" ); |
110 |
->status_is( 404, "404 for itemnumber containing different URI- pref off" ); |
| 109 |
$t->get_ok( $opac . $good_itemnumber ) |
111 |
$t->get_ok( $opac . $good_itemnumber ) |
| 110 |
->status_is( 302, "302 for itemnumber with matching URI" ); |
112 |
->status_is( 404, "404 for itemnumber with matching URI - pref off" ); |
| 111 |
|
113 |
|
| 112 |
# Track |
114 |
# Track |
| 113 |
t::lib::Mocks::mock_preference( 'TrackClicks', 'track' ); |
115 |
C4::Context->set_preference( 'TrackClicks', 'track' ); |
| 114 |
$t->get_ok( $opac . $no_biblionumber ) |
116 |
$t->get_ok( $opac . $no_biblionumber ) |
| 115 |
->status_is( 404, "404 for no biblionumber" ); |
117 |
->status_is( 404, "404 for no biblionumber" ); |
| 116 |
$t->get_ok( $opac . $bad_biblionumber1 ) |
118 |
$t->get_ok( $opac . $bad_biblionumber1 ) |
|
Lines 125-131
subtest 'open redirection vulnerabilities in tracklinks' => sub {
Link Here
|
| 125 |
->status_is( 302, "302 for itemnumber with matching URI" ); |
127 |
->status_is( 302, "302 for itemnumber with matching URI" ); |
| 126 |
|
128 |
|
| 127 |
# Track Anonymous |
129 |
# Track Anonymous |
| 128 |
t::lib::Mocks::mock_preference( 'TrackClicks', 'anonymous' ); |
130 |
C4::Context->set_preference( 'TrackClicks', 'anonymous' ); |
| 129 |
$t->get_ok( $opac . $no_biblionumber ) |
131 |
$t->get_ok( $opac . $no_biblionumber ) |
| 130 |
->status_is( 404, "404 for no biblionumber" ); |
132 |
->status_is( 404, "404 for no biblionumber" ); |
| 131 |
$t->get_ok( $opac . $bad_biblionumber1 ) |
133 |
$t->get_ok( $opac . $bad_biblionumber1 ) |
| 132 |
- |
|
|