jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

more csrf protection for invoice and search (#2984)

Browse Source
This commit is contained in:
Kevin Papst
2021-12-02 18:01:51 +01:00
committed by GitHub
parent b0045a910c
commit 4e42911f3d
7 changed files with 73 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
tests/Controller/InvoiceControllerTest.php
View File

@@ -190,7 +190,9 @@ class InvoiceControllerTest extends ControllerBaseTest
'markAsExported' => 1,
];
$action = '/invoice/save-invoice/1/' . $template->getId() . '?' . http_build_query($urlParams);
$token = self::$container->get('security.csrf.token_manager')->getToken('invoice.create');
$action = '/invoice/save-invoice/1/' . $template->getId() . '?token=' . $token->getValue() . '&' . http_build_query($urlParams);
$this->request($client, $action);
$this->assertIsRedirect($client);
$this->assertRedirectUrl($client, '/invoice/show?id=', false);
@@ -286,9 +288,11 @@ class InvoiceControllerTest extends ControllerBaseTest
// but the datatable with all timesheets
$this->assertDataTableRowCount($client, 'datatable_invoice', 20);
$token = self::$container->get('security.csrf.token_manager')->getToken('invoice.create');
$form = $client->getCrawler()->filter('#invoice-print-form')->form();
$node = $form->getFormNode();
$node->setAttribute('action', $this->createUrl('/invoice/?createInvoice=true'));
$node->setAttribute('action', $this->createUrl('/invoice/?createInvoice=true&token=' . $token->getValue()));
$node->setAttribute('method', 'GET');
$client->submit($form, [
'template' => $template->getId(),
@@ -317,17 +321,20 @@ class InvoiceControllerTest extends ControllerBaseTest
self::assertInstanceOf(BinaryFileResponse::class, $response);
self::assertFileExists($response->getFile());
$this->request($client, '/invoice/change-status/' . $id . '/pending');
$token = self::$container->get('security.csrf.token_manager')->getToken('invoice.status');
$this->request($client, '/invoice/change-status/' . $id . '/pending/' . $token->getValue());
$this->assertIsRedirect($client, '/invoice/show');
$client->followRedirect();
$this->assertTrue($client->getResponse()->isSuccessful());
$this->request($client, '/invoice/change-status/' . $id . '/paid');
$token = self::$container->get('security.csrf.token_manager')->getToken('invoice.status');
$this->request($client, '/invoice/change-status/' . $id . '/paid/' . $token->getValue());
$this->assertTrue($client->getResponse()->isSuccessful());
$token = self::$container->get('security.csrf.token_manager')->getToken('invoice.status');
$this->assertHasValidationError(
$client,
'/invoice/change-status/' . $id . '/paid',
'/invoice/change-status/' . $id . '/paid/' . $token->getValue(),
'form[name=invoice_payment_date_form]',
[
'invoice_payment_date_form' => [
@@ -350,7 +357,8 @@ class InvoiceControllerTest extends ControllerBaseTest
$client->followRedirect();
$this->assertTrue($client->getResponse()->isSuccessful());
$this->request($client, '/invoice/change-status/' . $id . '/new');
$token = self::$container->get('security.csrf.token_manager')->getToken('invoice.status');
$this->request($client, '/invoice/change-status/' . $id . '/new/' . $token->getValue());
$this->assertIsRedirect($client, '/invoice/show');
$client->followRedirect();
$this->assertTrue($client->getResponse()->isSuccessful());