Bug 34426

Summary: Add tests for CSRF checks missing
Product: Koha Reporter: Tomás Cohen Arazi (tcohen) <tomascohen>
Component: Architecture, internals, and plumbingAssignee: Martin Renvoize (ashimema) <martin.renvoize>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: enhancement    
Priority: P5 - low CC: 1joynelson, dcook, didier.gautheron, fridolin.somers, jonathan.druart, laurent.ducos, lucas, m.de.rooy, martin.renvoize, nick, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00
Circulation function:
Bug Depends on: 30524    
Bug Blocks: 34478    
Attachments: Bug 34426: Add xt/find-missing-csrf.t
Bug 34426: (QA follow-up) Polishing xt script

Description Tomás Cohen Arazi (tcohen) 2023-07-26 20:59:41 UTC
See bug 30524.
Comment 1 Tomás Cohen Arazi (tcohen) 2023-07-26 21:04:18 UTC
Created attachment 153940 [details] [review]
Bug 34426: Add xt/find-missing-csrf.t

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 2 Tomás Cohen Arazi (tcohen) 2023-07-26 21:04:54 UTC
Created attachment 153941 [details] [review]
Bug 34426: (QA follow-up) Polishing xt script

Test plan:
Run it again. Same results?

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 3 Martin Renvoize (ashimema) 2023-07-27 08:23:28 UTC
Marking blocked to make sure it's not accidentally picked before we're resolved all the existing cases.. we should definitely use this to help us find and fix all the remainin occurences.
Comment 4 David Cook 2023-08-01 01:03:32 UTC
(In reply to Martin Renvoize from comment #3)
> Marking blocked to make sure it's not accidentally picked before we're
> resolved all the existing cases.. we should definitely use this to help us
> find and fix all the remainin occurences.

+1
Comment 5 Jonathan Druart 2023-08-01 15:21:29 UTC
I guess there is as well the POST/PUT/DELETE/PATCH from the js files. They are mainly about the svc scripts.
Comment 6 Jonathan Druart 2023-08-04 07:06:04 UTC
 59 is( @errors, 0, "Template variables should be correctly escaped" )
 60     or diag(Dumper @errors);

This should be removed.
Comment 7 Jonathan Druart 2023-08-04 07:41:13 UTC
There are 2 occurrences of method="GET" that this script is not catching.
Comment 8 Jonathan Druart 2024-02-28 13:43:32 UTC
This will be embedded with bug 34478.
Comment 9 Jonathan Druart 2024-03-01 13:17:58 UTC
Pushed to master for 24.05.00.