Commit Graph

11 Commits

Author SHA1 Message Date
Jonathan Druart 849f67988f
Bug 41076: Adjust our perl tidiness for v20250105
Generated using
  `perl misc/devel/tidy.pl --perl`

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-02-05 09:03:51 -07:00
Jonathan Druart ad3ca52450
Bug 39980: Add Test::NoWarnings
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-18 13:52:07 -06:00
Julian Maurice 54f84f232a
Bug 39980: Add tests for .../acquisition/vendors* in Mojo context
Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-09-18 13:52:06 -06:00
Jonathan Druart 63eb2e1f4a
Bug 40444: Add a test to ensure all Perl test files use Test::NoWarnings
This patch adds a new xt test (xt/use-test-no-warnings.t) to make sure
all our Perl test files will use Test::NoWarnings.

It also adds Test::NoWarnings to some files that were missing it and
that didn't need any other changes.

However we still have 7 non-trivial tests that we will consider
exception for now, until they are fixed.

Test plan:
  prove xt/use-test-no-warnings.t
should return green.
And all other tests modified by this patch (the qa script will do that
for you)

You can also test the 2 selenium tests:
1. DROP and CREATE the DB
  DROP DATABASE koha_kohadev;
  CREATE DATABASE koha_kohadev;
  restart_all
2. KOHA_TESTING=1 prove t/db_dependent/selenium/00-onboarding.t
3. Repeat 1
2. KOHA_TESTING=1 prove t/db_dependent/selenium/01-installation.t

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2025-07-28 16:26:36 -06:00
Julian Maurice 58f6d7d73d
Bug 37286: Add tests for REST authentication through Mojo apps
Amended-by: Jonathan Druart
Add +x

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-17 08:21:23 +01:00
Jonathan Druart 5b69e6df98
Bug 38944: Add Test::NoWarnings to tests no producing warnings
This has been generated.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-03-13 17:25:03 +01:00
Victor Grousset/tuxayo 3972f5460a
Bug 36598: (QA follow-up): tidy up code
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-10-18 12:07:50 +02:00
Julian Maurice 36858c8c57
Bug 36598: Prevent use of unsafe HTTP method with non-cud op parameter
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-10-18 12:07:49 +02:00
Julian Maurice 4325e607cf
Bug 36598: Improve documentation and error message in CSRF plugin
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-10-18 12:07:48 +02:00
Julian Maurice 30670cba57
Bug 36598: Prohibit CUD operations with safe HTTP methods (GET/HEAD/...)
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-10-18 12:07:47 +02:00
Julian Maurice e61b92c8dd
Bug 36598: Enable CSRF protection for Mojolicious apps
Test plan:
1. Run bin/opac daemon -l http://*:3001/
2. Go to http://localhost:3001/cgi-bin/koha/opac-user.pl
3. With browser devtools, locate csrf_token hidden input within the
   login form and remove it or modify it
4. Try to submit the form with correct credentials, it should fail
   ("Wrong CSRF token")
5. Reload the page, try to log in normally without modifying the DOM, it
   should succeed
6. Run bin/intranet daemon -l http://*:3002/
7. Go to http://localhost:3002/cgi-bin/koha/mainpage.pl
8. With browser devtools, locate csrf_token hidden input within the
   login form and remove it or modify it
9. Try to submit the form with correct credentials, it should fail
   ("Wrong CSRF token")
10. Reload the page, try to log in normally without modifying the DOM,
    it should succeed
11. Run prove t/db_dependent/mojo/csrf.t

Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2024-10-18 12:07:47 +02:00