31a8f887a5
* bump version * fix formatting locale reset after embedded controller sub-requests (#5944) * fix GHSA-c6w6-57jj-62vh * fix GHSA-m492-gv72-xvxj * fix GHSA-jr9p-4h4j-6c58 * make sure to only use JS logic to call API endpoints * fixes GHSA-r8vr-m544-qh4h * make sure to only use JS logic to call API endpoints * fix GHSA-rw46-qg69-vg6h * fix GHSA-pj8j-p4g4-4vw8 - prevent kimai from rendering images via markdown * fix GHSA-pj8j-p4g4-4vw8 - use a safe network client to prevent SSRF via images * fix GHSA-xv4r-4885-gwpg * fix GHSA-pgcc-vfmc-7cw5 - move GET routes to API with POST method to prevent CSRF * fix tooltip survives page reload * updated wizard images * split wizard and password reset subscriber into two classes * relax upper php limit * added zizmor workflow scans and apply findings * user permissions <name>_other_profile now respect teams * move all linting steps to new job * updated docker image version names * use .env.local for storing APP_SECRET * improve build order and use given tag as ref for checkout, not default main branch * improved APP_SECRET handling, see entrypoint.sh * use local code for building the image for more flexibility, added dockerignore
82 lines
2.7 KiB
PHP
82 lines
2.7 KiB
PHP
<?php
|
|
|
|
/*
|
|
* This file is part of the Kimai time-tracking app.
|
|
*
|
|
* For the full copyright and license information, please view the LICENSE
|
|
* file that was distributed with this source code.
|
|
*/
|
|
|
|
namespace App\Tests\Security;
|
|
|
|
use App\Entity\User;
|
|
use App\Tests\KernelTestTrait;
|
|
use PHPUnit\Framework\Attributes\Group;
|
|
use Symfony\Bundle\FrameworkBundle\Test\KernelTestCase;
|
|
use Symfony\Component\HttpFoundation\Request;
|
|
use Symfony\Component\HttpFoundation\RequestStack;
|
|
use Symfony\Component\Security\Http\LoginLink\Exception\InvalidLoginLinkException;
|
|
use Symfony\Component\Security\Http\LoginLink\LoginLinkHandlerInterface;
|
|
|
|
/**
|
|
* Regression test for GHSA-m492-gv72-xvxj: a login link (used for password
|
|
* reset and admin on-demand login) must stop working once the user's password
|
|
* has been changed.
|
|
*/
|
|
#[Group('integration')]
|
|
class LoginLinkTest extends KernelTestCase
|
|
{
|
|
use KernelTestTrait;
|
|
|
|
private Request $request;
|
|
|
|
protected function setUp(): void
|
|
{
|
|
parent::setUp();
|
|
self::bootKernel();
|
|
|
|
// the login link handler is firewall-aware and needs an active request
|
|
// on the stack to resolve the firewall it belongs to
|
|
$this->request = Request::create('http://localhost/');
|
|
$stack = self::getContainer()->get(RequestStack::class);
|
|
self::assertInstanceOf(RequestStack::class, $stack);
|
|
$stack->push($this->request);
|
|
}
|
|
|
|
private function getLoginLinkHandler(): LoginLinkHandlerInterface
|
|
{
|
|
/** @var LoginLinkHandlerInterface $handler */
|
|
$handler = self::getContainer()->get(LoginLinkHandlerInterface::class);
|
|
|
|
return $handler;
|
|
}
|
|
|
|
public function testLoginLinkIsValidBeforePasswordChange(): void
|
|
{
|
|
$user = $this->getUserByRole(User::ROLE_USER);
|
|
$handler = $this->getLoginLinkHandler();
|
|
|
|
$link = $handler->createLoginLink($user, $this->request);
|
|
|
|
$consumed = $handler->consumeLoginLink(Request::create($link->getUrl()));
|
|
|
|
self::assertSame($user->getUserIdentifier(), $consumed->getUserIdentifier());
|
|
}
|
|
|
|
public function testLoginLinkIsRejectedAfterPasswordChange(): void
|
|
{
|
|
$user = $this->getUserByRole(User::ROLE_USER);
|
|
$handler = $this->getLoginLinkHandler();
|
|
|
|
$link = $handler->createLoginLink($user, $this->request);
|
|
|
|
// simulate the user completing the password reset wizard: the password
|
|
// hash changes, which must invalidate the signature of the old link
|
|
$user->setPassword('$2y$13$changedchangedchangedchangedchangedchangedchangedchangedchg');
|
|
$this->getEntityManager()->flush();
|
|
|
|
$this->expectException(InvalidLoginLinkException::class);
|
|
$handler->consumeLoginLink(Request::create($link->getUrl()));
|
|
}
|
|
}
|