jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

version 1.16.2 (#2942)

Browse Source 
* bump version
* include calendar week in week chooser
* table names in SQL
* show save flash message
* prevent migration warning
* drop default value to prevent error when server version is not set
* csrf token for duplicate actions
* updated translations
This commit is contained in:
Kevin Papst
2021-11-18 12:33:13 +01:00
committed by GitHub
parent c858edf5c9
commit b28e9c120c
37 changed files with 289 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
tests/Controller/ControllerBaseTest.php
View File

@@ -425,4 +425,14 @@ abstract class ControllerBaseTest extends WebTestCase
self::assertStringContainsString('attachment; filename=' . $prefix, $response->headers->get('Content-Disposition'));
self::assertStringContainsString('.xlsx', $response->headers->get('Content-Disposition'));
}
protected function assertInvalidCsrfToken(HttpKernelBrowser $client, string $url, string $expectedRedirect)
{
$this->request($client, $url);
$this->assertIsRedirect($client);
$this->assertRedirectUrl($client, $expectedRedirect);
$client->followRedirect();
$this->assertHasFlashError($client, 'The action could not be performed: invalid security token.');
}
}

7
tests/Controller/DoctorControllerTest.php
View File

@@ -34,4 +34,11 @@ class DoctorControllerTest extends ControllerBaseTest
$result = $client->getCrawler()->filter('.content .box-header');
self::assertCount(6, $result);
}
public function testFlushLogWithInvalidCsrf()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_SUPER_ADMIN);
$this->assertInvalidCsrfToken($client, '/doctor/flush-log/rsetdzfukgli78t6r5uedtjfzkugl', $this->createUrl('/doctor'));
}
}

23
tests/Controller/ProjectControllerTest.php
View File

@@ -216,7 +216,9 @@ class ProjectControllerTest extends ControllerBaseTest
$em->persist($rate);
$em->flush();
$this->request($client, '/admin/project/1/duplicate');
$token = self::$container->get('security.csrf.token_manager')->getToken('project.duplicate');
$this->request($client, '/admin/project/1/duplicate/' . $token);
$this->assertIsRedirect($client, '/details');
$client->followRedirect();
$node = $client->getCrawler()->filter('div.box#project_rates_box');
@@ -226,6 +228,25 @@ class ProjectControllerTest extends ControllerBaseTest
self::assertStringContainsString('123.45', $node->text(null, true));
}
public function testDuplicateActionWithInvalidCsrf()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
/** @var EntityManager $em */
$em = $this->getEntityManager();
$project = $em->find(Project::class, 1);
$project->setMetaField((new ProjectMeta())->setName('foo')->setValue('bar'));
$project->setEnd(new \DateTime());
$em->persist($project);
$activity = new Activity();
$activity->setName('blub');
$activity->setProject($project);
$activity->setMetaField((new ActivityMeta())->setName('blub')->setValue('blab'));
$em->persist($activity);
$em->flush();
$this->assertInvalidCsrfToken($client, '/admin/project/1/duplicate/rsetdzfukgli78t6r5uedtjfzkugl', $this->createUrl('/admin/project/1/details'));
}
public function testAddCommentAction()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);

11
tests/Controller/TeamControllerTest.php
View File

@@ -206,11 +206,20 @@ class TeamControllerTest extends ControllerBaseTest
public function testDuplicateAction()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$this->request($client, '/admin/teams/1/duplicate');
$token = self::$container->get('security.csrf.token_manager')->getToken('team.duplicate');
$this->request($client, '/admin/teams/1/duplicate/' . $token);
$this->assertIsRedirect($client, '/edit');
$client->followRedirect();
$node = $client->getCrawler()->filter('#team_edit_form_name');
self::assertEquals(1, $node->count());
self::assertEquals('Test team [COPY]', $node->attr('value'));
}
public function testDuplicateActionWithInvalidCsrf()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$this->assertInvalidCsrfToken($client, '/admin/teams/1/duplicate/rsetdzfukgli78t6r5uedtjfzkugl', $this->createUrl('/admin/teams/1/edit'));
}
}

33
tests/Controller/TimesheetControllerTest.php
View File

@@ -708,7 +708,9 @@ class TimesheetControllerTest extends ControllerBaseTest
$ids = $this->importFixture($fixture);
$newId = $ids[0]->getId();
$this->request($client, '/timesheet/' . $newId . '/duplicate');
$token = self::$container->get('security.csrf.token_manager')->getToken('timesheet.duplicate');
$this->request($client, '/timesheet/' . $newId . '/duplicate/' . $token);
$this->assertTrue($client->getResponse()->isSuccessful());
$form = $client->getCrawler()->filter('form[name=timesheet_edit_form]')->form();
@@ -730,4 +732,33 @@ class TimesheetControllerTest extends ControllerBaseTest
$this->assertEquals(2016, $timesheet->getFixedRate());
$this->assertEquals(2016, $timesheet->getRate());
}
public function testDuplicateActionWithInvalidCsrf()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$dateTime = new DateTimeFactory(new \DateTimeZone('Europe/London'));
$fixture = new TimesheetFixtures();
$fixture->setAmount(1);
$fixture->setAmountRunning(0);
$fixture->setUser($this->getUserByRole(User::ROLE_USER));
$fixture->setStartDate($dateTime->createDateTime());
$fixture->setCallback(function (Timesheet $timesheet) {
$timesheet->setDescription('Testing is fun!');
$begin = clone $timesheet->getBegin();
$begin->setTime(0, 0, 0);
$timesheet->setBegin($begin);
$end = clone $timesheet->getBegin();
$end->modify('+ 8 hours');
$timesheet->setEnd($end);
$timesheet->setFixedRate(2016);
$timesheet->setHourlyRate(127);
});
/** @var Timesheet[] $ids */
$ids = $this->importFixture($fixture);
$newId = $ids[0]->getId();
$this->assertInvalidCsrfToken($client, '/timesheet/' . $newId . '/duplicate/dfghdfghdfghdfghdfgh', $this->createUrl('/timesheet/'));
}
}

33
tests/Controller/TimesheetTeamControllerTest.php
View File

@@ -428,7 +428,9 @@ class TimesheetTeamControllerTest extends ControllerBaseTest
$ids = $this->importFixture($fixture);
$newId = $ids[0]->getId();
$this->request($client, '/team/timesheet/' . $newId . '/duplicate');
$token = self::$container->get('security.csrf.token_manager')->getToken('admin_timesheet.duplicate');
$this->request($client, '/team/timesheet/' . $newId . '/duplicate/' . $token);
$this->assertTrue($client->getResponse()->isSuccessful());
$form = $client->getCrawler()->filter('form[name=timesheet_admin_edit_form]')->form();
@@ -450,4 +452,33 @@ class TimesheetTeamControllerTest extends ControllerBaseTest
$this->assertEquals(2016, $timesheet->getFixedRate());
$this->assertEquals(2016, $timesheet->getRate());
}
public function testDuplicateActionWithInvalidCsrf()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$dateTime = new DateTimeFactory(new \DateTimeZone('Europe/London'));
$fixture = new TimesheetFixtures();
$fixture->setAmount(1);
$fixture->setAmountRunning(0);
$fixture->setUser($this->getUserByRole(User::ROLE_USER));
$fixture->setStartDate($dateTime->createDateTime());
$fixture->setCallback(function (Timesheet $timesheet) {
$timesheet->setDescription('Testing is fun!');
$begin = clone $timesheet->getBegin();
$begin->setTime(0, 0, 0);
$timesheet->setBegin($begin);
$end = clone $timesheet->getBegin();
$end->modify('+ 8 hours');
$timesheet->setEnd($end);
$timesheet->setFixedRate(2016);
$timesheet->setHourlyRate(127);
});
/** @var Timesheet[] $ids */
$ids = $this->importFixture($fixture);
$newId = $ids[0]->getId();
$this->assertInvalidCsrfToken($client, '/team/timesheet/' . $newId . '/duplicate/dfghdfghdfghdfghdfgh', $this->createUrl('/team/timesheet/'));
}
}