Bugzilla – Attachment 40348 Details for
Bug 14408
Path traversal vulnerabilty
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 14408: Add tests to get_template_and_user
Bug-14408-Add-tests-to-gettemplateanduser.patch (text/plain), 1.68 KB, created by
Jonathan Druart
on 2015-06-19 08:26:29 UTC
(
hide
)
Description:
Bug 14408: Add tests to get_template_and_user
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2015-06-19 08:26:29 UTC
Size:
1.68 KB
patch
obsolete
>From dcf9816f24c99a8c57334921c37cb099118b8c54 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@koha-community.org> >Date: Fri, 19 Jun 2015 10:25:30 +0200 >Subject: [PATCH] Bug 14408: Add tests to get_template_and_user > >--- > t/db_dependent/Auth.t | 23 ++++++++++++++++++++++- > 1 file changed, 22 insertions(+), 1 deletion(-) > >diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t >index 2cb1d5f..67816b2 100644 >--- a/t/db_dependent/Auth.t >+++ b/t/db_dependent/Auth.t >@@ -8,7 +8,7 @@ use Modern::Perl; > use CGI qw ( -utf8 ); > use Test::MockModule; > use List::MoreUtils qw/all any none/; >-use Test::More tests => 8; >+use Test::More tests => 11; > use C4::Members; > use Koha::AuthUtils qw/hash_password/; > >@@ -105,6 +105,27 @@ $dbh->{RaiseError} = 1; > > ok( ( any { $_->name eq 'KohaOpacLanguage' and $_->value eq 'en' } @$cookies ), > 'BZ9735: invalid language, then default to en'); >+ >+ for my $template_name ( >+ qw( >+ ../../../../../../../../../../../../../../../etc/passwd >+ test/../../../../../../../../../../../../../../etc/passwd >+ /etc/passwd >+ ) >+ ) { >+ my ( $template, $loggedinuser, $cookies ) = get_template_and_user( >+ { >+ template_name => $template_name, >+ query => $query, >+ type => "intranet", >+ authnotrequired => 1, >+ flagsrequired => { catalogue => 1 }, >+ } >+ ); >+ my $file_exists = ( -f $template->{filename} ) ? 1 : 0; >+ is ( $file_exists, 0, 'The file template_name should have been sanitize' ); >+ } >+ > } > > # Check that there is always an OPACBaseURL set. >-- >2.1.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 14408
:
40271
|
40336
|
40347
|
40348
|
40374
|
40375
|
40386
|
40387
|
40443
|
40445
|
40446
|
40447
|
40491
|
40492
|
40493
|
40564
|
40610