tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Reject invalid uploads and expand flow tests.

Browse Source
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent 716a609f4e
commit 8f4851e576
9 changed files with 427 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/php/Unit/SessionTest.php
+41
View File
@@ -140,6 +140,47 @@ class SessionTest extends TestCase {
$this->assertNotSame(persistent_key_hash('key'), $rows[0]['session'], 'the used key is gone');
}
public function testAUsedPersistentCookieCannotBeReplayedAndOtherDevicesStillWork(): void {
SiteData::$tables['editors'][] = array('username' => 'ed', 'password' => '', 'email' => '');
foreach (array('first-device', 'second-device') as $key) {
SiteData::$tables['persistent_sessions'][] = array('username' => 'ed', 'session' => persistent_key_hash($key),
'created' => gmdate('Y-m-d H:i:s'));
}
session_start();
$_COOKIE['PersistentAuth'] = 'ed|first-device';
$this->assertTrue(check_persistent_login());
$this->assertSame('ed', $_SESSION['editor']);
$rotated = SiteData::$tables['persistent_sessions'];
$this->assertCount(2, $rotated);
$this->assertNotContains(persistent_key_hash('first-device'), array_column($rotated, 'session'));
$this->assertContains(persistent_key_hash('second-device'), array_column($rotated, 'session'));
// Replay the old cookie without the authenticated PHP session.
session_destroy();
$_SESSION = array();
session_id(bin2hex(random_bytes(16)));
session_start();
$_COOKIE['PersistentAuth'] = 'ed|first-device';
$this->assertFalse(check_persistent_login());
$this->assertArrayNotHasKey('editor', $_SESSION);
$this->assertSame($rotated, SiteData::$tables['persistent_sessions']);
session_destroy();
$_SESSION = array();
session_id(bin2hex(random_bytes(16)));
session_start();
$_COOKIE['PersistentAuth'] = 'ed|second-device';
$this->assertTrue(check_persistent_login());
$this->assertSame('ed', $_SESSION['editor']);
$hashes = array_column(SiteData::$tables['persistent_sessions'], 'session');
$this->assertCount(2, $hashes);
$this->assertNotContains(persistent_key_hash('second-device'), $hashes);
foreach ($rotated as $row) {
if ($row['session'] !== persistent_key_hash('second-device'))
$this->assertContains($row['session'], $hashes, 'the first device keeps its rotated token');
}
}
public function testCheckPersistentLoginRefusesAnExpiredKey(): void {
SiteData::$tables['editors'][] = array('username' => 'ed', 'password' => '', 'email' => '');
SiteData::$tables['persistent_sessions'][] = array('username' => 'ed', 'session' => persistent_key_hash('key'),