Lines 194-206
subtest 'XSS vulnerabilities in pagination' => sub {
Link Here
|
194 |
{ |
194 |
{ |
195 |
class => 'Koha::Virtualshelves', |
195 |
class => 'Koha::Virtualshelves', |
196 |
value => { |
196 |
value => { |
197 |
category => 1, |
197 |
category => 2, |
198 |
allow_change_from_owner => 1, |
198 |
allow_change_from_owner => 1, |
199 |
allow_change_from_others => 0, |
199 |
allow_change_from_others => 0, |
200 |
owner => $patron->borrowernumber |
200 |
owner => $patron->borrowernumber |
201 |
} |
201 |
} |
202 |
} |
202 |
} |
203 |
); |
203 |
)->store; |
204 |
} |
204 |
} |
205 |
|
205 |
|
206 |
my $password = Koha::AuthUtils::generate_password(); |
206 |
my $password = Koha::AuthUtils::generate_password(); |
Lines 208-214
subtest 'XSS vulnerabilities in pagination' => sub {
Link Here
|
208 |
$patron->set_password({ password => $password }); |
208 |
$patron->set_password({ password => $password }); |
209 |
$s->opac_auth( $patron->userid, $password ); |
209 |
$s->opac_auth( $patron->userid, $password ); |
210 |
|
210 |
|
211 |
my $public_lists = $s->opac_base_url . q|opac-shelves.pl?op=list&category=1|; |
211 |
my $public_lists = $s->opac_base_url . q|opac-shelves.pl?op=list&category=2|; |
212 |
$driver->get($public_lists); |
212 |
$driver->get($public_lists); |
213 |
|
213 |
|
214 |
$s->remove_error_handler; |
214 |
$s->remove_error_handler; |
Lines 217-223
subtest 'XSS vulnerabilities in pagination' => sub {
Link Here
|
217 |
is( $alert_text, undef, 'No alert box displayed' ); |
217 |
is( $alert_text, undef, 'No alert box displayed' ); |
218 |
|
218 |
|
219 |
my $booh_alert = 'booh!'; |
219 |
my $booh_alert = 'booh!'; |
220 |
$public_lists = $s->opac_base_url . qq|opac-shelves.pl?op=list&category=1"><script>alert('$booh_alert')</script>|; |
220 |
$public_lists = $s->opac_base_url . qq|opac-shelves.pl?op=list&category=2"><script>alert('$booh_alert')</script>|; |
221 |
$driver->get($public_lists); |
221 |
$driver->get($public_lists); |
222 |
|
222 |
|
223 |
$s->remove_error_handler; |
223 |
$s->remove_error_handler; |
224 |
- |
|
|