gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 41812: Adjust find-missing-csrf.t test to ignore csrf input from JS 

This code injected the csrf token using the TT include file, that made
pass xt/find-missing-csrf.t

This bug removed the TT tags from the script tags, and we now need to
use a JS variable and retrieve the csrf token from the meta tag.

This patch suggests to adjust the script to ignore this case. We could
also rewrite the whole JS code and use built the HTML elements using
vanilla JS but that's for another day...

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Jonathan Druart 2026-02-10 21:14:57 +01:00 committed by Lucas Gass
parent 6adf1c1cc1
commit a019e78f4b
No known key found for this signature in database
GPG Key ID: 60B447398B0D36CA
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
xt/find-missing-csrf.t
View File

@ -50,7 +50,9 @@ sub check_csrf_in_forms {
for my $line (@lines) {
$line_number++;
$open = $line_number if $line =~ m{<form.*method=('|")post('|")}i;
$found++ if $open && $line =~ m{csrf-token\.inc};
$found++
if $open && $line =~ m{csrf-token\.inc}
|| $line =~ m{<input type="hidden" name="csrf_token" value="\$\{csrf_token\}" />};
if ( $open && $line =~ m{</form} ) {
push @errors, $open unless $found;
$found = 0;