Summary: | Add tests for CSRF checks missing | ||
---|---|---|---|
Product: | Koha | Reporter: | Tomás Cohen Arazi (tcohen) <tomascohen> |
Component: | Architecture, internals, and plumbing | Assignee: | Martin Renvoize (ashimema) <martin.renvoize> |
Status: | CLOSED FIXED | QA Contact: | Marcel de Rooy <m.de.rooy> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | 1joynelson, dcook, didier.gautheron, fridolin.somers, jonathan.druart, laurent.ducos, lucas, m.de.rooy, martin.renvoize, nick, tomascohen |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
24.05.00
|
|
Circulation function: | |||
Bug Depends on: | 30524 | ||
Bug Blocks: | 34478 | ||
Attachments: |
Bug 34426: Add xt/find-missing-csrf.t
Bug 34426: (QA follow-up) Polishing xt script |
Description
Tomás Cohen Arazi (tcohen)
2023-07-26 20:59:41 UTC
Created attachment 153940 [details] [review] Bug 34426: Add xt/find-missing-csrf.t Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Created attachment 153941 [details] [review] Bug 34426: (QA follow-up) Polishing xt script Test plan: Run it again. Same results? Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Marking blocked to make sure it's not accidentally picked before we're resolved all the existing cases.. we should definitely use this to help us find and fix all the remainin occurences. (In reply to Martin Renvoize from comment #3) > Marking blocked to make sure it's not accidentally picked before we're > resolved all the existing cases.. we should definitely use this to help us > find and fix all the remainin occurences. +1 I guess there is as well the POST/PUT/DELETE/PATCH from the js files. They are mainly about the svc scripts. 59 is( @errors, 0, "Template variables should be correctly escaped" ) 60 or diag(Dumper @errors); This should be removed. There are 2 occurrences of method="GET" that this script is not catching. Pushed to master for 24.05.00. |