jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Update CSRF Token IDs for Issue kevinpapst/kimai2#2947 (#2948)

Browse Source 
* bump version
* removed not needed token, as it is already contained in the form
Co-authored-by: Kevin Papst <kpapst@gmx.net>
This commit is contained in:
tdozbun-reno
2021-11-18 11:32:00 -06:00
committed by GitHub
parent b28e9c120c
commit 56d02673ed
16 changed files with 35 additions and 113 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
tests/Controller/CustomerControllerTest.php
View File

@@ -241,8 +241,10 @@ class CustomerControllerTest extends ControllerBaseTest
$this->assertIsRedirect($client, $this->createUrl('/admin/customer/1/details'));
$client->followRedirect();
$node = $client->getCrawler()->filter('div.box#comments_box .box-body a.btn.active');
$token2 = self::$container->get('security.csrf.token_manager')->getToken('customer.pin_comment');
self::assertEquals(1, $node->count());
self::assertEquals($this->createUrl('/admin/customer/' . $id . '/comment_pin/' . $token), $node->attr('href'));
self::assertEquals($this->createUrl('/admin/customer/' . $id . '/comment_pin/' . $token2), $node->attr('href'));
self::assertNotEquals($token, $token2);
}
public function testCreateDefaultTeamAction()

4
tests/Controller/ProjectControllerTest.php
View File

@@ -318,8 +318,10 @@ class ProjectControllerTest extends ControllerBaseTest
$this->assertIsRedirect($client, $this->createUrl('/admin/project/1/details'));
$client->followRedirect();
$node = $client->getCrawler()->filter('div.box#comments_box .box-body a.btn.active');
$token2 = self::$container->get('security.csrf.token_manager')->getToken('project.pin_comment');
self::assertEquals(1, $node->count());
self::assertEquals($this->createUrl('/admin/project/' . $id . '/comment_pin/' . $token), $node->attr('href'));
self::assertEquals($this->createUrl('/admin/project/' . $id . '/comment_pin/' . $token2), $node->attr('href'));
self::assertNotEquals($token, $token2);
}
public function testCreateDefaultTeamAction()

33
tests/Controller/TimesheetControllerTest.php
View File

@@ -708,9 +708,7 @@ class TimesheetControllerTest extends ControllerBaseTest
$ids = $this->importFixture($fixture);
$newId = $ids[0]->getId();
$token = self::$container->get('security.csrf.token_manager')->getToken('timesheet.duplicate');
$this->request($client, '/timesheet/' . $newId . '/duplicate/' . $token);
$this->request($client, '/timesheet/' . $newId . '/duplicate');
$this->assertTrue($client->getResponse()->isSuccessful());
$form = $client->getCrawler()->filter('form[name=timesheet_edit_form]')->form();
@@ -732,33 +730,4 @@ class TimesheetControllerTest extends ControllerBaseTest
$this->assertEquals(2016, $timesheet->getFixedRate());
$this->assertEquals(2016, $timesheet->getRate());
}
public function testDuplicateActionWithInvalidCsrf()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$dateTime = new DateTimeFactory(new \DateTimeZone('Europe/London'));
$fixture = new TimesheetFixtures();
$fixture->setAmount(1);
$fixture->setAmountRunning(0);
$fixture->setUser($this->getUserByRole(User::ROLE_USER));
$fixture->setStartDate($dateTime->createDateTime());
$fixture->setCallback(function (Timesheet $timesheet) {
$timesheet->setDescription('Testing is fun!');
$begin = clone $timesheet->getBegin();
$begin->setTime(0, 0, 0);
$timesheet->setBegin($begin);
$end = clone $timesheet->getBegin();
$end->modify('+ 8 hours');
$timesheet->setEnd($end);
$timesheet->setFixedRate(2016);
$timesheet->setHourlyRate(127);
});
/** @var Timesheet[] $ids */
$ids = $this->importFixture($fixture);
$newId = $ids[0]->getId();
$this->assertInvalidCsrfToken($client, '/timesheet/' . $newId . '/duplicate/dfghdfghdfghdfghdfgh', $this->createUrl('/timesheet/'));
}
}

33
tests/Controller/TimesheetTeamControllerTest.php
View File

@@ -428,9 +428,7 @@ class TimesheetTeamControllerTest extends ControllerBaseTest
$ids = $this->importFixture($fixture);
$newId = $ids[0]->getId();
$token = self::$container->get('security.csrf.token_manager')->getToken('admin_timesheet.duplicate');
$this->request($client, '/team/timesheet/' . $newId . '/duplicate/' . $token);
$this->request($client, '/team/timesheet/' . $newId . '/duplicate');
$this->assertTrue($client->getResponse()->isSuccessful());
$form = $client->getCrawler()->filter('form[name=timesheet_admin_edit_form]')->form();
@@ -452,33 +450,4 @@ class TimesheetTeamControllerTest extends ControllerBaseTest
$this->assertEquals(2016, $timesheet->getFixedRate());
$this->assertEquals(2016, $timesheet->getRate());
}
public function testDuplicateActionWithInvalidCsrf()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$dateTime = new DateTimeFactory(new \DateTimeZone('Europe/London'));
$fixture = new TimesheetFixtures();
$fixture->setAmount(1);
$fixture->setAmountRunning(0);
$fixture->setUser($this->getUserByRole(User::ROLE_USER));
$fixture->setStartDate($dateTime->createDateTime());
$fixture->setCallback(function (Timesheet $timesheet) {
$timesheet->setDescription('Testing is fun!');
$begin = clone $timesheet->getBegin();
$begin->setTime(0, 0, 0);
$timesheet->setBegin($begin);
$end = clone $timesheet->getBegin();
$end->modify('+ 8 hours');
$timesheet->setEnd($end);
$timesheet->setFixedRate(2016);
$timesheet->setHourlyRate(127);
});
/** @var Timesheet[] $ids */
$ids = $this->importFixture($fixture);
$newId = $ids[0]->getId();
$this->assertInvalidCsrfToken($client, '/team/timesheet/' . $newId . '/duplicate/dfghdfghdfghdfghdfgh', $this->createUrl('/team/timesheet/'));
}
}