jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

improve csrf handling (#2936)

Browse Source
This commit is contained in:
Kevin Papst
2021-11-16 10:17:26 +01:00
committed by GitHub
parent a1992494d3
commit 95796ab256
15 changed files with 122 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
tests/Controller/CustomerControllerTest.php
View File

@@ -176,19 +176,43 @@ class CustomerControllerTest extends ControllerBaseTest
]);
$this->assertIsRedirect($client, $this->createUrl('/admin/customer/1/details'));
$client->followRedirect();
$token = self::$container->get('security.csrf.token_manager')->getToken('customer.delete_comment');
$node = $client->getCrawler()->filter('div.box#comments_box .direct-chat-msg');
self::assertStringContainsString('Blah foo bar', $node->html());
$node = $client->getCrawler()->filter('div.box#comments_box .box-body a.confirmation-link');
self::assertStringEndsWith('/comment_delete', $node->attr('href'));
self::assertStringEndsWith('/comment_delete/' . $token, $node->attr('href'));
$comments = $this->getEntityManager()->getRepository(CustomerComment::class)->findAll();
$id = $comments[0]->getId();
$this->request($client, '/admin/customer/' . $id . '/comment_delete/' . $token);
$this->assertIsRedirect($client, $this->createUrl('/admin/customer/1/details'));
$client->followRedirect();
$node = $client->getCrawler()->filter('div.box#comments_box .box-body');
self::assertStringContainsString('There were no comments posted yet', $node->html());
}
public function testDeleteCommentActionWithoutToken()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$this->assertAccessIsGranted($client, '/admin/customer/1/details');
$form = $client->getCrawler()->filter('form[name=customer_comment_form]')->form();
$client->submit($form, [
'customer_comment_form' => [
'message' => 'Blah foo bar',
]
]);
$this->assertIsRedirect($client, $this->createUrl('/admin/customer/1/details'));
$client->followRedirect();
$comments = $this->getEntityManager()->getRepository(CustomerComment::class)->findAll();
$id = $comments[0]->getId();
$this->request($client, '/admin/customer/' . $id . '/comment_delete');
$this->assertIsRedirect($client, $this->createUrl('/admin/customer/1/details'));
$client->followRedirect();
$node = $client->getCrawler()->filter('div.box#comments_box .box-body');
self::assertStringContainsString('There were no comments posted yet', $node->html());
$this->assertRouteNotFound($client);
}
public function testPinCommentAction()
@@ -211,12 +235,14 @@ class CustomerControllerTest extends ControllerBaseTest
$comments = $this->getEntityManager()->getRepository(CustomerComment::class)->findAll();
$id = $comments[0]->getId();
$this->request($client, '/admin/customer/' . $id . '/comment_pin');
$token = self::$container->get('security.csrf.token_manager')->getToken('customer.pin_comment');
$this->request($client, '/admin/customer/' . $id . '/comment_pin/' . $token);
$this->assertIsRedirect($client, $this->createUrl('/admin/customer/1/details'));
$client->followRedirect();
$node = $client->getCrawler()->filter('div.box#comments_box .box-body a.btn.active');
self::assertEquals(1, $node->count());
self::assertEquals($this->createUrl('/admin/customer/' . $id . '/comment_pin'), $node->attr('href'));
self::assertEquals($this->createUrl('/admin/customer/' . $id . '/comment_pin/' . $token), $node->attr('href'));
}
public function testCreateDefaultTeamAction()