tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Ignore request values that are not strings.

Browse Source 
An array action or username no longer causes a PHP error.
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent be814a3ba5
commit 52f4855850
6 changed files with 27 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/php/Pages/EditTest.php
+7
View File
@@ -72,6 +72,13 @@ class EditTest extends PageTestCase {
$this->assertSame(array('5', 'Changed', 'Needs work'), array($row['id'], $row['title'], $row['comments']));
}
public function testAnArrayActionIsIgnored(): void {
$this->loginAs();
$page = $this->post('/publish/edit', array('action' => array('delete'), 'id' => '1'));
$this->assertSame(200, $page['status']);
$this->assertSame(array(), $this->queries('/^(DELETE|INSERT|UPDATE)/'));
}
public function testDeletingNeedsTheToken(): void {
$page = $this->post('/publish/edit', array('action' => 'delete', 'id' => '1', 'queue' => '0', 'csrf_token' => 'wrong'));
$this->assertStringContainsString('Your session has expired.', $page['body']);