From f5ad424d0ecbb9606c0cb52287ecd359a7abd10b Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Tue, 19 Jun 2018 17:00:22 -0300
Subject: [PATCH] Bug 13618: [DO NOT PUSH] have fun

In order to generate quickly a lot of relevant data I have modified a
bit TestBuilder->_gen_text to insert <script> tags in DB. The
transaction have been removed from t/db_dependent/Koha/Patrons.t

To use it, use a clean data (sample data only) the run
t/db_dependent/Koha/Patrons.t (only once, it will fail it you run it
more)
Search for patrons, without this patch you will get a looot of alert
boxes.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
---
 t/db_dependent/Koha/Patrons.t |  6 ------
 t/lib/TestBuilder.pm          | 10 ++++++++--
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/t/db_dependent/Koha/Patrons.t b/t/db_dependent/Koha/Patrons.t
index 6521db1a51..43a1b969c1 100644
--- a/t/db_dependent/Koha/Patrons.t
+++ b/t/db_dependent/Koha/Patrons.t
@@ -40,7 +40,6 @@ use t::lib::TestBuilder;
 use t::lib::Mocks;
 
 my $schema = Koha::Database->new->schema;
-$schema->storage->txn_begin;
 
 my $builder       = t::lib::TestBuilder->new;
 my $library = $builder->build({source => 'Branch' });
@@ -1425,7 +1424,6 @@ subtest 'Log cardnumber change' => sub {
     is( scalar @logs, 2, 'With BorrowerLogs, Change in cardnumber should be logged, as well as general alert of patron mod.' );
 };
 
-$schema->storage->txn_rollback;
 
 subtest 'Test Koha::Patrons::merge' => sub {
     plan tests => 110;
@@ -1434,7 +1432,6 @@ subtest 'Test Koha::Patrons::merge' => sub {
 
     my $resultsets = $Koha::Patron::RESULTSET_PATRON_ID_MAPPING;
 
-    $schema->storage->txn_begin;
 
     my $keeper  = $builder->build_object({ class => 'Koha::Patrons' });
     my $loser_1 = $builder->build({ source => 'Borrower' })->{borrowernumber};
@@ -1469,13 +1466,11 @@ subtest 'Test Koha::Patrons::merge' => sub {
     is( Koha::Patrons->find($loser_1), undef, 'Loser 1 has been deleted' );
     is( Koha::Patrons->find($loser_2), undef, 'Loser 2 has been deleted' );
 
-    $schema->storage->txn_rollback;
 };
 
 subtest '->store' => sub {
     plan tests => 3;
     my $schema = Koha::Database->new->schema;
-    $schema->storage->txn_begin;
 
     my $print_error = $schema->storage->dbh->{PrintError};
     $schema->storage->dbh->{PrintError} = 0; ; # FIXME This does not longer work - because of the transaction in Koha::Patron->store?
@@ -1497,7 +1492,6 @@ subtest '->store' => sub {
     is( $patron_1->password, $digest, 'Password should not have changed on ->store');
 
     $schema->storage->dbh->{PrintError} = $print_error;
-    $schema->storage->txn_rollback;
 };
 
 
diff --git a/t/lib/TestBuilder.pm b/t/lib/TestBuilder.pm
index c44e8895ea..2a3dfb3b72 100644
--- a/t/lib/TestBuilder.pm
+++ b/t/lib/TestBuilder.pm
@@ -433,14 +433,20 @@ sub _gen_datetime {
 sub _gen_text {
     my ($self, $params) = @_;
     # From perldoc String::Random
-    my $size = $params->{info}{size} // 10;
+    my $size = $params->{info}{size} // 100;
     $size -= alt_rand(0.5 * $size);
+    my $xss_data;
+    if ( $size > 27 ) { #<script>alert('');</script>
+        $xss_data = 1;
+        $size -= 27;
+    }
     my $regex = $size > 1
         ? '[A-Za-z][A-Za-z0-9_]{'.($size-1).'}'
         : '[A-Za-z]';
     my $random = String::Random->new( rand_gen => \&alt_rand );
     # rand_gen is only supported from 0.27 onward
-    return $random->randregex($regex);
+    $random = $random->randregex($regex);
+    return $xss_data ? qq|<script>alert('$random');</script>| : $random;
 }
 
 sub alt_rand { #Alternative randomizer
-- 
2.18.0