jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Release 2.47 (#5784)

Browse Source
This commit is contained in:
Kevin Papst
2026-01-25 09:51:22 +01:00
committed by GitHub
parent 6a86afb5fd
commit d429c56687
81 changed files with 2487 additions and 3801 deletions
Download Patch File Download Diff File Expand all files Collapse all files

66
tests/Twig/SecurityPolicy/ChainPolicyTest.php
View File

@@ -1,66 +0,0 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Tests\Twig\SecurityPolicy;
use App\Twig\SecurityPolicy\ChainPolicy;
use PHPUnit\Framework\Attributes\CoversClass;
use PHPUnit\Framework\TestCase;
use Twig\Sandbox\SecurityPolicyInterface;
#[CoversClass(ChainPolicy::class)]
class ChainPolicyTest extends TestCase
{
public function testCheckSecurity(): void
{
$policy1 = $this->createMock(SecurityPolicyInterface::class);
$policy1->expects(self::once())->method('checkSecurity')->with(['tag'], ['filter'], ['function']);
$policy2 = $this->createMock(SecurityPolicyInterface::class);
$policy2->expects(self::once())->method('checkSecurity')->with(['tag'], ['filter'], ['function']);
$sut = new ChainPolicy();
$sut->addPolicy($policy1);
$sut->addPolicy($policy2);
$sut->checkSecurity(['tag'], ['filter'], ['function']);
}
public function testCheckMethodAllowed(): void
{
$obj = new \stdClass();
$policy1 = $this->createMock(SecurityPolicyInterface::class);
$policy1->expects(self::once())->method('checkMethodAllowed')->with($obj, 'method');
$policy2 = $this->createMock(SecurityPolicyInterface::class);
$policy2->expects(self::once())->method('checkMethodAllowed')->with($obj, 'method');
$sut = new ChainPolicy();
$sut->addPolicy($policy1);
$sut->addPolicy($policy2);
$sut->checkMethodAllowed($obj, 'method');
}
public function testCheckPropertyAllowed(): void
{
$obj = new \stdClass();
$policy1 = $this->createMock(SecurityPolicyInterface::class);
$policy1->expects(self::once())->method('checkPropertyAllowed')->with($obj, 'property');
$policy2 = $this->createMock(SecurityPolicyInterface::class);
$policy2->expects(self::once())->method('checkPropertyAllowed')->with($obj, 'property');
$sut = new ChainPolicy();
$sut->addPolicy($policy1);
$sut->addPolicy($policy2);
$sut->checkPropertyAllowed($obj, 'property');
}
}

23
tests/Twig/SecurityPolicy/DefaultPolicyTest.php
View File

@@ -1,23 +0,0 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Tests\Twig\SecurityPolicy;
use App\Twig\SecurityPolicy\DefaultPolicy;
use PHPUnit\Framework\Attributes\CoversClass;
use Twig\Sandbox\SecurityPolicyInterface;
#[CoversClass(DefaultPolicy::class)]
class DefaultPolicyTest extends AbstractPolicyTestCase
{
protected function createPolicy(): SecurityPolicyInterface
{
return new DefaultPolicy();
}
}

23
tests/Twig/SecurityPolicy/ExportPolicyTest.php
View File

@@ -1,23 +0,0 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Tests\Twig\SecurityPolicy;
use App\Twig\SecurityPolicy\ExportPolicy;
use PHPUnit\Framework\Attributes\CoversClass;
use Twig\Sandbox\SecurityPolicyInterface;
#[CoversClass(ExportPolicy::class)]
class ExportPolicyTest extends AbstractPolicyTestCase
{
protected function createPolicy(): SecurityPolicyInterface
{
return new ExportPolicy();
}
}

90
tests/Twig/SecurityPolicy/InvoicePolicyTest.php
View File

@@ -1,90 +0,0 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Tests\Twig\SecurityPolicy;
use App\Entity\User;
use App\Pdf\PdfContext;
use App\Twig\SecurityPolicy\InvoicePolicy;
use PHPUnit\Framework\Attributes\CoversClass;
use PHPUnit\Framework\Attributes\DataProvider;
use PHPUnit\Framework\TestCase;
use Symfony\Bridge\Twig\AppVariable;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\ServerBag;
use Symfony\Component\HttpFoundation\Session\SessionInterface;
use Symfony\Component\String\UnicodeString;
use Twig\Sandbox\SecurityNotAllowedMethodError;
use Twig\Sandbox\SecurityPolicyInterface;
#[CoversClass(InvoicePolicy::class)]
class InvoicePolicyTest extends TestCase
{
protected function createPolicy(): SecurityPolicyInterface
{
return new InvoicePolicy();
}
public function testCheckSecurity(): void
{
$sut = $this->createPolicy();
$sut->checkSecurity([], [], []);
$this->expectNotToPerformAssertions();
}
#[DataProvider('getCheckMethodAllowedData')]
public function testCheckMethodAllowed(object $obj, string $method, ?string $expectedExceptionMessage = null): void
{
$sut = $this->createPolicy();
if ($expectedExceptionMessage !== null) {
$this->expectException(SecurityNotAllowedMethodError::class);
$this->expectExceptionMessage($expectedExceptionMessage);
}
$sut->checkMethodAllowed($obj, $method);
if ($expectedExceptionMessage === null) {
$this->expectNotToPerformAssertions();
}
}
public static function getCheckMethodAllowedData(): array
{
return [
[new ServerBag(), 'get', 'Tried to access server environment'],
[self::createStub(SessionInterface::class), 'getId', 'Tried to access session'],
[new \stdClass(), 'foo', 'Tried to access non-read method'],
[new \stdClass(), 'setFoo', 'Tried to access non-read method'],
[new \stdClass(), 'getFoo'],
[new \stdClass(), 'hasFoo'],
[new \stdClass(), 'isFoo'],
[new UnicodeString(), '__toString'],
// Request
[new Request(), 'get', null],
[new Request(), 'isXmlHttpRequest', 'Tried to call setter() of app variable'],
[new Request(), 'hasSession', 'Tried to call setter() of app variable'],
// PdfContext
[new PdfContext(), 'setOption'],
[new PdfContext(), 'getOption', 'Tried to access forbidden method on PdfContext'],
// AppVariable
[new AppVariable(), 'getRequest'],
[new AppVariable(), 'getUser'],
[new AppVariable(), 'getLocale'],
[new AppVariable(), 'getCharset', 'Tried to access forbidden app variable method'],
// User
[new User(), 'getUsername'],
[new User(), 'getPassword', 'Tried to access user secrets'],
[new User(), 'getTotpSecret', 'Tried to access user secrets'],
[new User(), 'getPlainPassword', 'Tried to access user secrets'],
[new User(), 'getConfirmationToken', 'Tried to access user secrets'],
[new User(), 'getTotpAuthenticationConfiguration', 'Tried to access user secrets'],
];
}
}

10
tests/Twig/SecurityPolicy/AbstractPolicyTestCase.php → tests/Twig/SecurityPolicy/StrictPolicyTestCase.php
View File

@@ -11,6 +11,8 @@ namespace App\Tests\Twig\SecurityPolicy;
use App\Entity\User;
use App\Pdf\PdfContext;
use App\Twig\SecurityPolicy\StrictPolicy;
use PHPUnit\Framework\Attributes\CoversClass;
use PHPUnit\Framework\Attributes\DataProvider;
use PHPUnit\Framework\TestCase;
use Symfony\Bridge\Twig\AppVariable;
@@ -21,9 +23,13 @@ use Symfony\Component\String\UnicodeString;
use Twig\Sandbox\SecurityNotAllowedMethodError;
use Twig\Sandbox\SecurityPolicyInterface;
abstract class AbstractPolicyTestCase extends TestCase
#[CoversClass(StrictPolicy::class)]
class StrictPolicyTestCase extends TestCase
{
abstract protected function createPolicy(): SecurityPolicyInterface;
private function createPolicy(): SecurityPolicyInterface
{
return new StrictPolicy();
}
public function testCheckSecurity(): void
{