tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Ignore request values that are not strings.

Browse Source 
An array action or username no longer causes a PHP error.
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent be814a3ba5
commit 52f4855850
6 changed files with 27 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/php/Pages/LoginTest.php
+8
View File
@@ -39,6 +39,14 @@ class LoginTest extends PageTestCase {
$this->get('/publish/login', array('X-Test-Plain' => '1', 'Host' => 'evil.example')));
}
public function testAnArrayUsernameIsRefused(): void {
$token = $this->csrfToken($this->get('/publish/login')['body']);
$answer = $this->post('/publish/login', array('login' => '1', 'username' => array('ed'), 'password' => 'secret',
'csrf_token' => $token, 'g-recaptcha-response' => 'pass'));
$this->assertSame(200, $answer['status']);
$this->assertStringContainsString('Access denied.', $answer['body']);
}
public function testTheFormHasATokenAndTheCaptcha(): void {
$body = $this->get('/publish/login')['body'];
$this->assertSame($this->session()['csrf_token'], $this->csrfToken($body));