gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 36598: (QA follow-up): tidy up code 

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Victor Grousset/tuxayo 2024-05-14 20:39:00 +02:00 committed by Lucas Gass
parent 460a48cf69
commit 13b0aa1262
2 changed files with 22 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Koha/App/Plugin/CSRF.pm
View File

@ -75,12 +75,16 @@ sub register {
if ( $method eq 'GET' || $method eq 'HEAD' || $method eq 'OPTIONS' || $method eq 'TRACE' ) {
my $op = $c->req->param('op');
if ( $op && $op =~ /^cud-/ ) {
return $c->reply->exception('Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"')->rendered(400);
return $c->reply->exception(
'Incorrect use of a safe HTTP method with an `op` parameter that starts with "cud-"')
->rendered(400);
}
} else {
my $op = $c->req->param('op');
if ( $op && $op !~ /^cud-/ ) {
return $c->reply->exception('Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"')->rendered(400);
return $c->reply->exception(
'Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with "cud-"')
->rendered(400);
}
if ( $c->cookie('CGISESSID') && !$self->is_csrf_valid( $c->req ) ) {

24
t/db_dependent/mojo/csrf.t
View File

@ -43,15 +43,19 @@ subtest 'CSRF - Intranet' => sub {
subtest 'GETting what should be POSTed should fail' => sub {
plan tests => 3;
$t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400)
->content_like( qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with &quot;cud-&quot;/, 'Body contains correct error message' );
$t->get_ok('/cgi-bin/koha/mainpage.pl?op=cud-login')->status_is(400)->content_like(
qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with &quot;cud-&quot;/,
'Body contains correct error message'
);
};
subtest 'POSTing what should be GET should fail' => sub {
plan tests => 3;
$t->post_ok('/cgi-bin/koha/mainpage.pl?op=login')->status_is(400)
->content_like( qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with &quot;cud-&quot;/, 'Body contains correct error message' );
$t->post_ok('/cgi-bin/koha/mainpage.pl?op=login')->status_is(400)->content_like(
qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with &quot;cud-&quot;/,
'Body contains correct error message'
);
};
};
@ -91,14 +95,18 @@ subtest 'CSRF - OPAC' => sub {
subtest 'GETting what should be POSTed should fail' => sub {
plan tests => 3;
$t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400)
->content_like( qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with &quot;cud-&quot;/, 'Body contains correct error message' );
$t->get_ok('/cgi-bin/koha/opac-user.pl?op=cud-login')->status_is(400)->content_like(
qr/Incorrect use of a safe HTTP method with an `op` parameter that starts with &quot;cud-&quot;/,
'Body contains correct error message'
);
};
subtest 'POSTing what should be GET should fail' => sub {
plan tests => 3;
$t->post_ok('/cgi-bin/koha/opac-user.pl?op=login')->status_is(400)
->content_like( qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with &quot;cud-&quot;/, 'Body contains correct error message' );
$t->post_ok('/cgi-bin/koha/opac-user.pl?op=login')->status_is(400)->content_like(
qr/Incorrect use of an unsafe HTTP method with an `op` parameter that does not start with &quot;cud-&quot;/,
'Body contains correct error message'
);
};
};