From 8dc74a8a9df0960243901aec7d59da34ac623f0a Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 17 Mar 2020 11:54:12 +0100 Subject: [PATCH] Bug 24879: Add new test to catch missing auth statement in intranet scripts Signed-off-by: Martin Renvoize --- xt/find-missing-auth_checks.t | 72 +++++++++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100755 xt/find-missing-auth_checks.t diff --git a/xt/find-missing-auth_checks.t b/xt/find-missing-auth_checks.t new file mode 100755 index 0000000000..bc9af3a6c2 --- /dev/null +++ b/xt/find-missing-auth_checks.t @@ -0,0 +1,72 @@ +#!/usr/bin/perl + +# This file is part of Koha. +# +# Koha is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# Koha is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Koha; if not, see . + +use Modern::Perl; +use Test::More; + +use File::Spec; +use File::Find; + +my @files; +sub wanted { + my $name = $File::Find::name; + push @files, $name + if $name =~ m{^\./( + acqui + |admin + |authorities + |basket + |catalogue + |cataloguing + |circ + |clubs + |course_reserves + |installer + |labels + |members + |patroncards + |pos + |reports + |reserve + |reviews + |rotating_collections + |serials + |services + |suggestion + |svc + |tags + |tools + |virtualshelves + )}xms + && $name =~ m{\.(pl)$} + && -f $name; +} + +find({ wanted => \&wanted, no_chdir => 1 }, File::Spec->curdir()); + +my @missing_auth_check; +FILE: foreach my $name (@files) { + open( FILE, $name ) || die "cannot open file $name $!"; + while ( my $line = ) { + for my $routine ( qw( get_template_and_user check_cookie_auth checkauth check_api_auth ) ) { + next FILE if $line =~ m|^[^#]*$routine|; + } + } + push @missing_auth_check, $name; +} +is( scalar @missing_auth_check, 0 ) or diag "No auth check in the following files:\n" . join "\n", @missing_auth_check; +done_testing; -- 2.20.1