Bugzilla – Attachment 119721 Details for
Bug 21325
Prevent authentication when sending userid and password via querystring parameters
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 21325: Add tests
Bug-21325-Add-tests.patch (text/plain), 2.36 KB, created by
Jonathan Druart
on 2021-04-16 12:14:11 UTC
(
hide
)
Description:
Bug 21325: Add tests
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2021-04-16 12:14:11 UTC
Size:
2.36 KB
patch
obsolete
>From 0444fd4c6d8f5e62a907338f516829d01c961472 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Fri, 16 Apr 2021 14:13:45 +0200 >Subject: [PATCH] Bug 21325: Add tests > >--- > t/db_dependent/Auth.t | 32 +++++++++++++++++++++++++++++++- > 1 file changed, 31 insertions(+), 1 deletion(-) > >diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t >index b221797221..a612b1a599 100755 >--- a/t/db_dependent/Auth.t >+++ b/t/db_dependent/Auth.t >@@ -38,7 +38,7 @@ $schema->storage->txn_begin; > > subtest 'checkauth() tests' => sub { > >- plan tests => 3; >+ plan tests => 4; > > my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => undef } }); > >@@ -78,6 +78,36 @@ subtest 'checkauth() tests' => sub { > # FIXME This belongs to t/db_dependent/Auth/haspermission.t but we do not want to c/p the pervious mock statements > ok( !$is_allowed, 'DB user should not have any permissions'); > >+ subtest 'Prevent authentication when sending credential via GET' => sub { >+ >+ plan tests => 2; >+ >+ my $patron = $builder->build_object( >+ { class => 'Koha::Patrons', value => { flags => 1 } } ); >+ my $password = 'password'; >+ t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 ); >+ $patron->set_password( { password => $password } ); >+ $cgi = Test::MockObject->new(); >+ $cgi->mock( 'cookie', sub { return; } ); >+ $cgi->mock( >+ 'param', >+ sub { >+ my ( $self, $param ) = @_; >+ if ( $param eq 'userid' ) { return $patron->userid; } >+ elsif ( $param eq 'password' ) { return $password; } >+ else { return; } >+ } >+ ); >+ >+ $cgi->mock( 'request_method', sub { return 'POST' } ); >+ ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth( $cgi, 'authrequired' ); >+ is( $userid, $patron->userid, 'If librarian user is used and password with POST, they should be logged in' ); >+ >+ $cgi->mock( 'request_method', sub { return 'GET' } ); >+ ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth( $cgi, 'authrequired' ); >+ is( $userid, undef, 'If librarian user is used and password with GET, they should not be logged in' ); >+ }; >+ > C4::Context->_new_userenv; # For next tests > > }; >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 21325
:
114695
|
114696
|
119600
|
119601
|
119697
|
119698
| 119721