From cb2e4523f3015c31aaed8e410d49ee19c6e7182d Mon Sep 17 00:00:00 2001
From: Andrew Ruthven <andrew@etc.gen.nz>
Date: Wed, 28 Feb 2024 00:30:48 +1300
Subject: [PATCH] Add test for invalidating the CSRF token

---
 .../tests/webui/0004-principal-edit.result    |  5 +++-
 testing/tests/webui/0004-principal-edit.test  | 23 ++++++++++++++++++-
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/testing/tests/webui/0004-principal-edit.result b/testing/tests/webui/0004-principal-edit.result
index 0ba16c2e..6a5aa692 100644
--- a/testing/tests/webui/0004-principal-edit.result
+++ b/testing/tests/webui/0004-principal-edit.result
@@ -1,4 +1,4 @@
-1..40
+1..43
 # Subtest: Login
     1..4
     ok 1 - Fetch first page
@@ -69,6 +69,9 @@ ok 37 - Access Tickets missing
 ok 38 - Principal Collections missing
 ok 39 - Bindings to other collections missing
 ok 40 - Bindings to this Principal's Collections missing
+ok 41 - Submit form with bogus CSRF fields
+ok 42 - Error message rejecting CSRF displayed
+ok 43 - Email field back to previous value
 
  date_format_type: >I<
          dav_name: >/user99/<
diff --git a/testing/tests/webui/0004-principal-edit.test b/testing/tests/webui/0004-principal-edit.test
index 60e81367..c01f9a68 100644
--- a/testing/tests/webui/0004-principal-edit.test
+++ b/testing/tests/webui/0004-principal-edit.test
@@ -1,4 +1,4 @@
-MODE=TAP,40
+MODE=TAP,43
 
 BEGINPERL
 
@@ -185,6 +185,27 @@ for my $missing_text ('Change Password', 'Confirm Password', 'Group Memberships'
     $mech->content_lacks($missing_text, "$missing_text missing");
 }
 
+# Invalidate the CSRF token to make sure the correct error is thrown.
+$mech->follow_link( text_regex => qr/View My Details/ );
+$mech->form_number(1);
+$mech->submit_form_ok(
+    {
+        form_number => 1,
+        button      => 'submit',
+        fields      => {
+            csrf_token  => 'bogus',
+            email       => 'bogus-csrf@example.net',
+        },
+    }, "Submit form with bogus CSRF fields"
+);
+
+$mech->content_contains(
+    'A valid CSRF token must be provided',
+    'Error message rejecting CSRF displayed');
+
+is($mech->value('email'), 'user99@example.net', 'Email field back to previous value');
+
+
 ENDPERL