View | Details | Raw Unified | Return to bug 22478
Collapse All | Expand All

(-)a/t/db_dependent/selenium/regressions.t (-1 / +47 lines)
Lines 19-25 use Modern::Perl; Link Here
19
19
20
use C4::Context;
20
use C4::Context;
21
21
22
use Test::More tests => 4;
22
use Test::More tests => 5;
23
use Test::MockModule;
23
use Test::MockModule;
24
24
25
use C4::Context;
25
use C4::Context;
Lines 186-191 subtest 'Display circulation table correctly' => sub { Link Here
186
      $patron->category, $library;
186
      $patron->category, $library;
187
};
187
};
188
188
189
subtest 'XSS vulnerabilities in pagination' => sub {
190
    plan tests => 3;
191
192
    my $patron = $builder->build_object({ class => 'Koha::Patrons' });
193
    for ( 1 .. 30 ) { # We want the pagination to be displayed
194
        push @cleanup, $builder->build_object(
195
            {
196
                class => 'Koha::Virtualshelves',
197
                value => {
198
                    category                 => 1,
199
                    allow_change_from_owner  => 1,
200
                    allow_change_from_others => 0,
201
                    owner                    => $patron->borrowernumber
202
                }
203
            }
204
        );
205
    }
206
207
    my $password = Koha::AuthUtils::generate_password();
208
    t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 );
209
    $patron->set_password({ password => $password });
210
    $s->opac_auth( $patron->userid, $password );
211
212
    my $public_lists = $s->opac_base_url . q|opac-shelves.pl?op=list&category=1|;
213
    $driver->get($public_lists);
214
215
    $s->remove_error_handler;
216
    my $alert_text = eval { $driver->get_alert_text() };
217
    $s->add_error_handler;
218
    is( $alert_text, undef, 'No alert box displayed' );
219
220
    my $booh_alert = 'booh!';
221
    $public_lists = $s->opac_base_url . qq|opac-shelves.pl?op=list&category=1"><script>alert('$booh_alert')</script>|;
222
    $driver->get($public_lists);
223
224
    $s->remove_error_handler;
225
    $alert_text = eval { $driver->get_alert_text() };
226
    $s->add_error_handler;
227
    is( $alert_text, undef, 'No alert box displayed, even if evil intent' );
228
229
    my $second_page = $driver->find_element('//div[@class="pages"]/span[@class="currentPage"]/following-sibling::a');
230
    like( $second_page->get_attribute('href'), qr{category=1%22%3E%3Cscript%3Ealert%28%27booh%21%27%29%3C%2Fscript%3E}, 'The second patch should displayed the variables and attributes correctly URI escaped' );
231
232
    push @cleanup, $patron, $patron->category, $patron->library;
233
};
234
189
END {
235
END {
190
    C4::Context->set_preference('SearchEngine', $SearchEngine_value);
236
    C4::Context->set_preference('SearchEngine', $SearchEngine_value);
191
    C4::Context->set_preference('AudioAlerts', $AudioAlerts_value);
237
    C4::Context->set_preference('AudioAlerts', $AudioAlerts_value);
(-)a/t/lib/Selenium.pm (-4 / +32 lines)
Lines 49-55 sub new { Link Here
49
    $self->{driver} = Selenium::Remote::Driver->new(
49
    $self->{driver} = Selenium::Remote::Driver->new(
50
        port               => $self->{selenium_port},
50
        port               => $self->{selenium_port},
51
        remote_server_addr => $self->{selenium_addr},
51
        remote_server_addr => $self->{selenium_addr},
52
        error_handler => sub {
52
    );
53
    bless $self, $class;
54
    $self->add_error_handler;
55
    return $self;
56
}
57
58
sub add_error_handler {
59
    my ( $self ) = @_;
60
    $self->{driver}->error_handler(
61
        sub {
53
            my ( $driver, $selenium_error ) = @_;
62
            my ( $driver, $selenium_error ) = @_;
54
            print STDERR "\nSTRACE:";
63
            print STDERR "\nSTRACE:";
55
            my $i = 1;
64
            my $i = 1;
Lines 57-67 sub new { Link Here
57
                print STDERR "\t" . $call_details[1]. ":" . $call_details[2] . " in " . $call_details[3]."\n";
66
                print STDERR "\t" . $call_details[1]. ":" . $call_details[2] . " in " . $call_details[3]."\n";
58
            }
67
            }
59
            print STDERR "\n";
68
            print STDERR "\n";
60
            $class->capture( $driver );
69
            $self->capture( $driver );
61
            croak $selenium_error;
70
            croak $selenium_error;
62
        }
71
        }
63
    );
72
    );
64
    return bless $self, $class;
73
}
74
75
sub remove_error_handler {
76
    my ( $self ) = @_;
77
    $self->{driver}->error_handler( sub {} );
65
}
78
}
66
79
67
sub config {
80
sub config {
Lines 95-100 sub opac_auth { Link Here
95
    $password ||= $self->password;
108
    $password ||= $self->password;
96
    my $mainpage = $self->opac_base_url . 'opac-main.pl';
109
    my $mainpage = $self->opac_base_url . 'opac-main.pl';
97
110
111
    $self->driver->get($mainpage . q|?logout.x=1|); # Logout before, to make sure we will see the login form
98
    $self->driver->get($mainpage);
112
    $self->driver->get($mainpage);
99
    $self->fill_form( { userid => $login, password => $password } );
113
    $self->fill_form( { userid => $login, password => $password } );
100
    $self->submit_form;
114
    $self->submit_form;
Lines 240-245 when we use automation test using Selenium Link Here
240
Capture a screenshot and upload it using the excellent lut.im service provided by framasoft
254
Capture a screenshot and upload it using the excellent lut.im service provided by framasoft
241
The url of the image will be printed on STDERR (it should be better to return it instead)
255
The url of the image will be printed on STDERR (it should be better to return it instead)
242
256
257
=head2 add_error_handler
258
    $c->add_error_handler
259
260
Add our specific error handler to the driver.
261
It will displayed a trace as well as capture a screenshot of the current screen.
262
So only case you should need it is after you called remove_error_handler
263
264
=head remove_error_handler
265
    $c->remove_error_handler
266
267
Do *not* call this method if you are not aware of what it will do!
268
It will remove any kinds of error raised by the driver.
269
It can be useful in some cases, for instance if you want to make sure something will not happen and that could make the driver exploses otherwise.
270
You certainly should call it for only one statement then must call add_error_handler right after.
271
243
=head1 AUTHORS
272
=head1 AUTHORS
244
273
245
Jonathan Druart <jonathan.druart@bugs.koha-community.org>
274
Jonathan Druart <jonathan.druart@bugs.koha-community.org>
246
- 

Return to bug 22478