Bugzilla – Attachment 166920 Details for
Bug 36875
SQL injection in additional content pages
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36875: Unit test
Bug-36875-Unit-test.patch (text/plain), 2.19 KB, created by
Victor Grousset/tuxayo
on 2024-05-19 03:54:16 UTC
(
hide
)
Description:
Bug 36875: Unit test
Filename:
MIME Type:
Creator:
Victor Grousset/tuxayo
Created:
2024-05-19 03:54:16 UTC
Size:
2.19 KB
patch
obsolete
>From b9935b98fc58b97565a71d9d3aeb23d7ba0a0b41 Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Thu, 16 May 2024 08:41:19 +0000 >Subject: [PATCH] Bug 36875: Unit test > >Test plan: >Run Koha/AdditionalContents.t without next patch. >Should fail on the sleep execution. > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> >--- > t/db_dependent/Koha/AdditionalContents.t | 35 ++++++++++++++++++++++-- > 1 file changed, 33 insertions(+), 2 deletions(-) > >diff --git a/t/db_dependent/Koha/AdditionalContents.t b/t/db_dependent/Koha/AdditionalContents.t >index 565b3fe3f8..14803874a3 100755 >--- a/t/db_dependent/Koha/AdditionalContents.t >+++ b/t/db_dependent/Koha/AdditionalContents.t >@@ -19,7 +19,7 @@ > > use Modern::Perl; > >-use Test::More tests => 6; >+use Test::More tests => 7; > use Test::Exception; > > use Koha::AdditionalContents; >@@ -328,4 +328,35 @@ subtest 'find_best_match' => sub { > # Note: find_best_match is tested further via $libary->opac_info; see t/db_dependent/Koha/Library.t > > $schema->storage->txn_rollback; >- } >+}; >+ >+subtest '->translated_content' => sub { >+ plan tests => 4; >+ >+ $schema->storage->txn_begin; >+ >+ my $page = $builder->build_object( >+ { >+ class => 'Koha::AdditionalContents', >+ value => { category => 'pages', branchcode => undef }, >+ } >+ ); >+ $page->translated_contents( >+ [ >+ { title => 'T', content => 'C1', lang => 'default' }, >+ { title => 'T', content => 'C2', lang => 'nl-NL' }, >+ { title => 'T', content => 'C3', lang => 'de' }, >+ ] >+ ); >+ is( $page->translated_content('nl-NL')->content, 'C2', 'Found translation' ); >+ is( $page->translated_content('de')->content, 'C3', 'Found translation' ); >+ >+ # Passing a sleep with language parameter (executed before 36875) >+ my $hack = q|de') OR (SELECT 1 FROM (SELECT(SLEEP(10)))x)-- -|; >+ my $time1 = time; >+ is( $page->translated_content($hack)->content, 'C1', 'Hacking language param' ); >+ my $time2 = time; >+ ok( $time2 < $time1 + 10, 'The sleep has not been executed' ); >+ >+ $schema->storage->txn_rollback; >+}; >-- >2.45.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36875
:
166804
|
166805
|
166806
|
166832
|
166833
|
166872
|
166873
|
166874
|
166875
|
166918
|
166919
|
166920
|
166921
|
167029
|
167030
|
167031
|
167032