View | Details | Raw Unified | Return to bug 23329
Collapse All | Expand All

(-)a/t/db_dependent/www/regressions.t (-1 / +138 lines)
Line 0 Link Here
0
- 
1
#!/usr/bin/env perl
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <http://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
20
use Test::More tests => 1;
21
use Test::Mojo;
22
use t::lib::TestBuilder;
23
use t::lib::Mocks;
24
25
use C4::Context;
26
use C4::Biblio;
27
28
use Koha::Database;
29
30
use MARC::Field;
31
32
my $intranet =
33
  $ENV{KOHA_INTRANET_URL} || C4::Context->preference("staffClientBaseURL");
34
my $opac = $ENV{KOHA_OPAC_URL} || C4::Context->preference("OPACBaseURL");
35
36
my $t       = Test::Mojo->new();
37
my $schema  = Koha::Database->new->schema;
38
my $builder = t::lib::TestBuilder->new;
39
40
subtest 'open redirection vulnerabilities in tracklinks' => sub {
41
    plan tests => 30;
42
43
    $schema->storage->txn_begin;
44
45
    # No URI's
46
    my $biblio        = $builder->build_sample_biblio();
47
    my $biblionumber1 = $biblio->biblionumber;
48
49
    # Incorrect URI at Biblio level
50
    $biblio = $builder->build_sample_biblio();
51
    my $biblionumber2 = $biblio->biblionumber;
52
    my $record = $biblio->metadata->record;
53
    my $new856 = MARC::Field->new( '856', '', '', u => "www.bing.com" );
54
    $record->insert_fields_ordered($new856);
55
    C4::Biblio::ModBiblio( $record, $biblionumber2 );
56
57
    # URI at Biblio level
58
    $biblio = $builder->build_sample_biblio();
59
    my $biblionumber3 = $biblio->biblionumber;
60
    $record        = $biblio->metadata->record;
61
    $new856 = MARC::Field->new( '856', '', '', u => "www.google.com" );
62
    $record->insert_fields_ordered($new856);
63
    C4::Biblio::ModBiblio( $record, $biblionumber3 );
64
65
    # URI at Item level
66
    my $item = $builder->build_sample_item( { uri => 'www.google.com' } );
67
    my $itemnumber1 = $item->itemnumber;
68
69
    # Incorrect URI at Item level
70
    $item = $builder->build_sample_item( { uri => 'www.bing.com ' } );
71
    my $itemnumber2 = $item->itemnumber;
72
73
    my $no_biblionumber =
74
      '/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com';
75
    my $bad_biblionumber1 =
76
      '/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber='
77
      . $biblionumber1;
78
    my $bad_biblionumber2 =
79
      '/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber='
80
      . $biblionumber2;
81
    my $good_biblionumber =
82
      '/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber='
83
      . $biblionumber3;
84
    my $bad_itemnumber =
85
      '/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&itemnumber='
86
      . $itemnumber2;
87
    my $good_itemnumber =
88
      '/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&itemnumber='
89
      . $itemnumber1;
90
91
    # Don't Track
92
    t::lib::Mocks::mock_preference( 'TrackClicks', '' );
93
    $t->get_ok( $opac . $no_biblionumber )
94
      ->status_is( 404, "404 for no biblionumber" );
95
    $t->get_ok( $opac . $bad_biblionumber1 )
96
      ->status_is( 404, "404 for biblionumber containing no URI" );
97
    $t->get_ok( $opac . $bad_biblionumber2 )
98
      ->status_is( 404, "404 for biblionumber containing different URI" );
99
    $t->get_ok( $opac . $good_biblionumber )
100
      ->status_is( 302, "302 for biblionumber with matching URI" );
101
    $t->get_ok( $opac . $bad_itemnumber )
102
      ->status_is( 404, "404 for itemnumber containing different URI" );
103
    $t->get_ok( $opac . $good_itemnumber )
104
      ->status_is( 302, "302 for itemnumber with matching URI" );
105
106
    # Track
107
    t::lib::Mocks::mock_preference( 'TrackClicks', 'track' );
108
    $t->get_ok( $opac . $no_biblionumber )
109
      ->status_is( 404, "404 for no biblionumber" );
110
    $t->get_ok( $opac . $bad_biblionumber1 )
111
      ->status_is( 404, "404 for biblionumber containing no URI" );
112
    $t->get_ok( $opac . $bad_biblionumber2 )
113
      ->status_is( 404, "404 for biblionumber containing different URI" );
114
    $t->get_ok( $opac . $good_biblionumber )
115
      ->status_is( 302, "302 for biblionumber with matching URI" );
116
    $t->get_ok( $opac . $bad_itemnumber )
117
      ->status_is( 404, "404 for itemnumber containing different URI" );
118
    $t->get_ok( $opac . $good_itemnumber )
119
      ->status_is( 302, "302 for itemnumber with matching URI" );
120
121
    # Track Anonymous
122
    t::lib::Mocks::mock_preference( 'TrackClicks', 'anonymous' );
123
    $t->get_ok( $opac . $no_biblionumber )
124
      ->status_is( 404, "404 for no biblionumber" );
125
    $t->get_ok( $opac . $bad_biblionumber1 )
126
      ->status_is( 404, "404 for biblionumber containing no URI" );
127
    $t->get_ok( $opac . $bad_biblionumber2 )
128
      ->status_is( 404, "404 for biblionumber containing different URI" );
129
    $t->get_ok( $opac . $good_biblionumber )
130
      ->status_is( 302, "302 for biblionumber with matching URI" );
131
    $t->get_ok( $opac . $bad_itemnumber )
132
      ->status_is( 404, "404 for itemnumber containing different URI" );
133
    $t->get_ok( $opac . $good_itemnumber )
134
      ->status_is( 302, "302 for itemnumber with matching URI" );
135
136
    $schema->storage->txn_rollback;
137
};
138

Return to bug 23329