tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Ignore request values that are not strings.

Browse Source 
An array action or username no longer causes a PHP error.
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent be814a3ba5
commit 52f4855850
6 changed files with 27 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/php/Pages/EditTest.php
+7
View File
@@ -72,6 +72,13 @@ class EditTest extends PageTestCase {
$this->assertSame(array('5', 'Changed', 'Needs work'), array($row['id'], $row['title'], $row['comments']));
}
public function testAnArrayActionIsIgnored(): void {
$this->loginAs();
$page = $this->post('/publish/edit', array('action' => array('delete'), 'id' => '1'));
$this->assertSame(200, $page['status']);
$this->assertSame(array(), $this->queries('/^(DELETE|INSERT|UPDATE)/'));
}
public function testDeletingNeedsTheToken(): void {
$page = $this->post('/publish/edit', array('action' => 'delete', 'id' => '1', 'queue' => '0', 'csrf_token' => 'wrong'));
$this->assertStringContainsString('Your session has expired.', $page['body']);
tests/php/Pages/LoginTest.php
+8
View File
@@ -39,6 +39,14 @@ class LoginTest extends PageTestCase {
$this->get('/publish/login', array('X-Test-Plain' => '1', 'Host' => 'evil.example')));
}
public function testAnArrayUsernameIsRefused(): void {
$token = $this->csrfToken($this->get('/publish/login')['body']);
$answer = $this->post('/publish/login', array('login' => '1', 'username' => array('ed'), 'password' => 'secret',
'csrf_token' => $token, 'g-recaptcha-response' => 'pass'));
$this->assertSame(200, $answer['status']);
$this->assertStringContainsString('Access denied.', $answer['body']);
}
public function testTheFormHasATokenAndTheCaptcha(): void {
$body = $this->get('/publish/login')['body'];
$this->assertSame($this->session()['csrf_token'], $this->csrfToken($body));
tests/php/Pages/SubmitTest.php
+7
View File
@@ -111,6 +111,13 @@ class SubmitTest extends PageTestCase {
$this->assertSame(array(), $this->queries('/^INSERT/'));
}
public function testAnArrayActionIsIgnored(): void {
$page = $this->post('/publish', array('action' => array('post')));
$this->assertSame(200, $page['status']);
$this->assertStringNotContainsString('Please review your submission.', $page['body']);
$this->assertSame(array(), $this->queries('/^INSERT/'));
}
public function testFieldsAreEscapedInTheForm(): void {
$token = $this->csrfToken($this->get('/publish')['body']);
$page = $this->post('/publish', $this->story(array('action' => 'preview', 'csrf_token' => $token, 'g-recaptcha-response' => 'pass',