nik/davical
1
0
Fork 0
mirror of https://gitlab.com/davical-project/davical.git synced 2026-08-09 15:06:05 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add test for invalidating the CSRF token

Browse Source
This commit is contained in:
Andrew Ruthven 2024-02-28 00:30:48 +13:00
parent 0a0c0a77cc
commit cb2e4523f3
2 changed files with 26 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
testing/tests/webui/0004-principal-edit.result
View File

@ -1,4 +1,4 @@
1..40
1..43
# Subtest: Login
1..4
ok 1 - Fetch first page
@ -69,6 +69,9 @@ ok 37 - Access Tickets missing
ok 38 - Principal Collections missing
ok 39 - Bindings to other collections missing
ok 40 - Bindings to this Principal's Collections missing
ok 41 - Submit form with bogus CSRF fields
ok 42 - Error message rejecting CSRF displayed
ok 43 - Email field back to previous value
date_format_type: >I<
dav_name: >/user99/<

23
testing/tests/webui/0004-principal-edit.test
View File

@ -1,4 +1,4 @@
MODE=TAP,40
MODE=TAP,43
BEGINPERL
@ -185,6 +185,27 @@ for my $missing_text ('Change Password', 'Confirm Password', 'Group Memberships'
$mech->content_lacks($missing_text, "$missing_text missing");
}
# Invalidate the CSRF token to make sure the correct error is thrown.
$mech->follow_link( text_regex => qr/View My Details/ );
$mech->form_number(1);
$mech->submit_form_ok(
{
form_number => 1,
button => 'submit',
fields => {
csrf_token => 'bogus',
email => 'bogus-csrf@example.net',
},
}, "Submit form with bogus CSRF fields"
);
$mech->content_contains(
'A valid CSRF token must be provided',
'Error message rejecting CSRF displayed');
is($mech->value('email'), 'user99@example.net', 'Email field back to previous value');
ENDPERL