View | Details | Raw Unified | Return to bug 34478
Collapse All | Expand All

(-)a/cypress.config.ts (+3 lines)
Lines 7-12 export default defineConfig({ Link Here
7
    defaultCommandTimeout: 10000,
7
    defaultCommandTimeout: 10000,
8
8
9
    e2e: {
9
    e2e: {
10
        setupNodeEvents(on, config) {
11
            return require("./t/cypress/plugins/index.js")(on, config);
12
        },
10
        experimentalStudio: true,
13
        experimentalStudio: true,
11
        baseUrl: "http://kohadev-intra.mydnsname.org:8081",
14
        baseUrl: "http://kohadev-intra.mydnsname.org:8081",
12
        specPattern: "t/cypress/integration/**/*.*",
15
        specPattern: "t/cypress/integration/**/*.*",
(-)a/t/cypress/integration/Auth/csrf.ts (-1 / +153 lines)
Line 0 Link Here
0
- 
1
import { mount } from "@cypress/vue";
2
3
const branchcode = "TEST_LIB";
4
const branchname = "test_branchname";
5
6
function cleanup() {
7
    const sql = "DELETE FROM branches WHERE branchcode=?";
8
    cy.query(sql, branchcode);
9
}
10
11
describe("CSRF", () => {
12
    beforeEach(() => {
13
        cy.login();
14
        cy.title().should("eq", "Koha staff interface");
15
    });
16
17
    before(function () {
18
        cleanup();
19
    });
20
    after(function () {
21
        cleanup();
22
    });
23
24
    it("Add using POST without csrf", () => {
25
        cy.visit("/cgi-bin/koha/admin/branches.pl");
26
27
        cy.get("#newbranch").click();
28
        cy.get("#Aform").find("input[name='csrf_token']").invoke("remove");
29
        cy.get("#branchcode").type(branchcode);
30
        cy.get("#branchname").type(branchname);
31
        cy.get("#Aform").contains("Submit").click();
32
33
        cy.get("main")
34
            .find(".message")
35
            .contains(/Wrong CSRF token/);
36
37
        cy.query(
38
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
39
            branchcode
40
        ).then(result => {
41
            expect(result[0].count).to.equal(0);
42
        });
43
    });
44
45
    it("Add using GET", () => {
46
        // Trying correct op=cud-add_validate
47
        cy.visit(
48
            "/cgi-bin/koha/admin/branches.pl?op=cud-add_validate&branchcode=" +
49
                branchcode +
50
                "&branchname=" +
51
                branchname
52
        );
53
54
        // We do not display a message
55
        // We do not want Wrong CSRF token here
56
        cy.get(".message").should("not.exist");
57
58
        // Trying incorrect op=add_validate
59
        cy.visit(
60
            "/cgi-bin/koha/admin/branches.pl?op=add_validate&branchcode=" +
61
                branchcode +
62
                "&branchname=" +
63
                branchname
64
        );
65
66
        // We do not display a message
67
        // We do not want Wrong CSRF token here
68
        cy.get(".message").should("not.exist");
69
70
        cy.query(
71
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
72
            branchcode
73
        ).then(result => {
74
            expect(result[0].count).to.equal(0);
75
        });
76
    });
77
78
    it("Add", () => {
79
        cy.visit("/cgi-bin/koha/admin/branches.pl");
80
81
        cy.get("#newbranch").click();
82
        cy.get("#branchcode").type(branchcode);
83
        cy.get("#branchname").type(branchname);
84
        cy.get("#Aform").contains("Submit").click();
85
86
        cy.get("main")
87
            .find(".message")
88
            .contains(/Library added successfully/);
89
90
        cy.get("select[name='libraries_length']").select("-1");
91
        cy.get("td").contains(branchcode);
92
93
        cy.query(
94
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
95
            branchcode
96
        ).then(result => {
97
            expect(result[0].count).to.equal(1);
98
        });
99
    });
100
101
    it("Delete without CSRF", () => {
102
        cy.query("INSERT INTO branches(branchcode, branchname) VALUES (?, ?)", [
103
            branchcode,
104
            branchname,
105
        ]);
106
107
        cy.visit("/cgi-bin/koha/admin/branches.pl");
108
        cy.get("select[name='libraries_length']").select("-1");
109
        cy.get("#delete_library_" + branchcode).click();
110
111
        // Remove CSRF Token
112
        cy.get("form[method='post']")
113
            .find("input[name='csrf_token']")
114
            .invoke("remove");
115
116
        cy.contains("Yes, delete").click();
117
118
        cy.get("main")
119
            .find(".message")
120
            .contains(/Wrong CSRF token/);
121
122
        cy.query(
123
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
124
            branchcode
125
        ).then(result => {
126
            expect(result[0].count).to.equal(1);
127
        });
128
    });
129
130
    it("Delete", () => {
131
        cy.query("INSERT INTO branches(branchcode, branchname) VALUES (?, ?)", [
132
            branchcode,
133
            branchname,
134
        ]);
135
136
        cy.visit("/cgi-bin/koha/admin/branches.pl");
137
        cy.get("select[name='libraries_length']").select("-1");
138
        cy.get("#delete_library_" + branchcode).click();
139
140
        cy.contains("Yes, delete").click();
141
142
        cy.get("main")
143
            .find(".message")
144
            .contains(/Library deleted successfully/);
145
146
        cy.query(
147
            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
148
            branchcode
149
        ).then(result => {
150
            expect(result[0].count).to.equal(0);
151
        });
152
    });
153
});

Return to bug 34478