You've already forked postfixadmin
mirror of
https://github.com/postfixadmin/postfixadmin.git
synced 2026-10-24 12:19:19 +03:00
8a1f9a11af
possible fix for https://github.com/postfixadmin/postfixadmin/issues/967 CSRF Token changes : rather than have one PFA_Token value in $_SESSION, store a list of them, where each value has a time stamp it was issued on. The aim is to allow the user to have multiple browser tabs open at once - and not have the last tab that loaded trample on others. Tokens expire after 1 hour. Adds a Smarty helper function `{CSRF_Token}` which will output `<input type=hidden name=CSRF_Token value=asdf123>` or `{CSRF_Token type=url}` which outputs a literal string like 'asdf123' suitable for placing in a URL. Adds a PHP exception handler in public/common.php, which could be used to display a more friendly error message/response (but at the moment is fairly minimal). Removes most uses of `die()` within the codebase, and instead moves to throw an exception
50 lines
1.2 KiB
PHP
50 lines
1.2 KiB
PHP
<?php
|
|
|
|
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
class CsrfTokenTest extends TestCase
|
|
{
|
|
public function testBasic()
|
|
{
|
|
$token1 = CsrfToken::generate();
|
|
$token2 = CsrfToken::generate();
|
|
$this->assertNotEquals($token1, $token2);
|
|
$this->assertNotEmpty($token1);
|
|
$this->assertNotEmpty($token2);
|
|
|
|
$this->assertTrue(CsrfToken::assertValid($token1, true));
|
|
$this->assertTrue(CsrfToken::assertValid($token2, true));
|
|
|
|
$this->expectException(CsrfInvalidException::class);
|
|
CsrfToken::assertValid("different token", true);
|
|
|
|
}
|
|
|
|
public function testThatTokenCanOnlyBeUsedOnce()
|
|
{
|
|
$token1 = CsrfToken::generate();
|
|
|
|
$this->assertNotEmpty($token1);
|
|
$this->assertTrue(CsrfToken::assertValid($token1));
|
|
|
|
$this->expectException(CsrfInvalidException::class);
|
|
$this->assertTrue(CsrfToken::assertValid($token1));
|
|
|
|
}
|
|
|
|
|
|
public function testThatOrderOfUseDoesNotMatter()
|
|
{
|
|
$token1 = CsrfToken::generate();
|
|
$token2 = CsrfToken::generate();
|
|
|
|
$this->assertNotEmpty($token1);
|
|
$this->assertNotEmpty($token2);
|
|
|
|
$this->assertTrue(CsrfToken::assertValid($token2));
|
|
$this->assertTrue(CsrfToken::assertValid($token1));
|
|
|
|
}
|
|
}
|