Lines 33-39
is( length( $tokenizer->generate ), 1, "Generate without parameters" );
Link Here
|
33 |
my $token = $tokenizer->generate({ length => 20 }); |
33 |
my $token = $tokenizer->generate({ length => 20 }); |
34 |
is( length($token), 20, "Token $token has 20 chars" ); |
34 |
is( length($token), 20, "Token $token has 20 chars" ); |
35 |
|
35 |
|
36 |
my $id = $tokenizer->generate({ lyyGength => 8 }); |
36 |
my $id = $tokenizer->generate({ length => 8 }); |
37 |
my $csrftoken = $tokenizer->generate_csrf({ id => $id }); |
37 |
my $csrftoken = $tokenizer->generate_csrf({ id => $id }); |
38 |
isnt( length($csrftoken), 0, "Token $csrftoken should not be empty" ); |
38 |
isnt( length($csrftoken), 0, "Token $csrftoken should not be empty" ); |
39 |
|
39 |
|
Lines 62-75
isnt( $result, 1, "CSRF token expired after one second" );
Link Here
|
62 |
|
62 |
|
63 |
subtest 'Same id (cookie CGISESSID) with an other logged in user' => sub { |
63 |
subtest 'Same id (cookie CGISESSID) with an other logged in user' => sub { |
64 |
plan tests => 2; |
64 |
plan tests => 2; |
65 |
$csrftoken = $tokenizer->generate_csrf({ id => $id }); |
65 |
$csrftoken = $tokenizer->generate_csrf({ session_id => $id }); |
66 |
$result = $tokenizer->check_csrf({ |
66 |
$result = $tokenizer->check_csrf({ |
67 |
id => $id, token => $csrftoken, |
67 |
session_id => $id, token => $csrftoken, |
68 |
}); |
68 |
}); |
69 |
is( $result, 1, "CSRF token verified" ); |
69 |
is( $result, 1, "CSRF token verified" ); |
70 |
C4::Context->set_userenv(0,43,0,'firstname','surname', 'CPL', 'Library 1', 0, ', '); |
70 |
C4::Context->set_userenv(0,43,0,'firstname','surname', 'CPL', 'Library 1', 0, ', '); |
71 |
$result = $tokenizer->check_csrf({ |
71 |
$result = $tokenizer->check_csrf({ |
72 |
id => $id, token => $csrftoken, |
72 |
session_id => $id, token => $csrftoken, |
73 |
}); |
73 |
}); |
74 |
is( $result, '', "CSRF token is not verified if another logged in user is using the same id" ); |
74 |
is( $result, '', "CSRF token is not verified if another logged in user is using the same id" ); |
75 |
}; |
75 |
}; |
Lines 77-91
subtest 'Same id (cookie CGISESSID) with an other logged in user' => sub {
Link Here
|
77 |
subtest 'Same logged in user with another session (cookie CGISESSID)' => sub { |
77 |
subtest 'Same logged in user with another session (cookie CGISESSID)' => sub { |
78 |
plan tests => 2; |
78 |
plan tests => 2; |
79 |
C4::Context->set_userenv(0,42,0,'firstname','surname', 'CPL', 'Library 1', 0, ', '); |
79 |
C4::Context->set_userenv(0,42,0,'firstname','surname', 'CPL', 'Library 1', 0, ', '); |
80 |
$csrftoken = $tokenizer->generate_csrf({ id => $id }); |
80 |
$csrftoken = $tokenizer->generate_csrf({ session_id => $id }); |
81 |
$result = $tokenizer->check_csrf({ |
81 |
$result = $tokenizer->check_csrf({ |
82 |
id => $id, token => $csrftoken, |
82 |
session_id => $id, token => $csrftoken, |
83 |
}); |
83 |
}); |
84 |
is( $result, 1, "CSRF token verified" ); |
84 |
is( $result, 1, "CSRF token verified" ); |
85 |
# Get another session id |
85 |
# Get another session id |
86 |
$id = $tokenizer->generate({ lyyGength => 8 }); |
86 |
$id = $tokenizer->generate({ length => 8 }); |
87 |
$result = $tokenizer->check_csrf({ |
87 |
$result = $tokenizer->check_csrf({ |
88 |
id => $id, token => $csrftoken, |
88 |
session_id => $id, token => $csrftoken, |
89 |
}); |
89 |
}); |
90 |
is( $result, '', "CSRF token is not verified if another session is used" ); |
90 |
is( $result, '', "CSRF token is not verified if another session is used" ); |
91 |
}; |
91 |
}; |
92 |
- |
|
|