gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 38365: (follow-up) Only get the nonce in templates if CSP is enabled, add tests 

To test:
1. prove t/db_dependent/Koha/Template/Plugin/Koha.t

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This commit is contained in:
Lari Taskula 2026-02-24 13:47:15 +02:00 committed by Jonathan Druart
parent c8bfd03386
commit dc15cc3a04
No known key found for this signature in database
GPG Key ID: A085E712BEF0E0F0
1 changed files with 19 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
t/db_dependent/Koha/Template/Plugin/Koha.t
View File

@ -29,6 +29,8 @@ use Koha::Cache::Memory::Lite;
use Koha::Database;
use Koha::Template::Plugin::Koha;
use t::lib::Mocks;
my $schema = Koha::Database->new->schema;
my $session_id = 42;
@ -81,7 +83,7 @@ subtest 'GenerateCSRF - New CSRF token generated every time we need one' => sub
};
subtest 'CSPNonce' => sub {
plan tests => 1;
plan tests => 3;
$schema->storage->txn_begin;
@ -90,12 +92,25 @@ subtest 'CSPNonce' => sub {
my $plugin = Koha::Template::Plugin::Koha->new($context);
my $csp = Koha::ContentSecurityPolicy->new;
C4::Context->interface('opac');
t::lib::Mocks::mock_config(
'content_security_policy',
{ 'opac' => { csp_mode => 'enabled', csp_header_value => 'test' } }
);
my $csp = Koha::ContentSecurityPolicy->new;
$csp->set_nonce();
my $nonce = $csp->get_nonce;
my $token = $plugin->CSPNonce;
is( $plugin->CSPNonce, $nonce, 'the correct nonce was provided' );
like( $nonce, qr/^\w{22}$/, 'nonce is a random string of 22 characters' );
t::lib::Mocks::mock_config(
'content_security_policy',
{ 'opac' => { csp_mode => 'disabled', csp_header_value => 'test' } }
);
is( $plugin->CSPNonce, undef, 'no nonce was provided because CSP is dsabled' );
$schema->storage->txn_rollback;