From 195a25ed7b08455106f3ab0875e7f37da715af13 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Fri, 19 Jun 2015 10:25:30 +0200 Subject: [PATCH] [SIGNED OFF] Bug 14408: Add tests to get_template_and_user Signed-off-by: Katrin Fischer --- t/db_dependent/Auth.t | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t index 2cb1d5f..67816b2 100644 --- a/t/db_dependent/Auth.t +++ b/t/db_dependent/Auth.t @@ -8,7 +8,7 @@ use Modern::Perl; use CGI qw ( -utf8 ); use Test::MockModule; use List::MoreUtils qw/all any none/; -use Test::More tests => 8; +use Test::More tests => 11; use C4::Members; use Koha::AuthUtils qw/hash_password/; @@ -105,6 +105,27 @@ $dbh->{RaiseError} = 1; ok( ( any { $_->name eq 'KohaOpacLanguage' and $_->value eq 'en' } @$cookies ), 'BZ9735: invalid language, then default to en'); + + for my $template_name ( + qw( + ../../../../../../../../../../../../../../../etc/passwd + test/../../../../../../../../../../../../../../etc/passwd + /etc/passwd + ) + ) { + my ( $template, $loggedinuser, $cookies ) = get_template_and_user( + { + template_name => $template_name, + query => $query, + type => "intranet", + authnotrequired => 1, + flagsrequired => { catalogue => 1 }, + } + ); + my $file_exists = ( -f $template->{filename} ) ? 1 : 0; + is ( $file_exists, 0, 'The file template_name should have been sanitize' ); + } + } # Check that there is always an OPACBaseURL set. -- 1.7.10.4