diff options
Diffstat (limited to 'qa/t/test_security.t')
| -rw-r--r-- | qa/t/test_security.t | 61 |
1 files changed, 37 insertions, 24 deletions
diff --git a/qa/t/test_security.t b/qa/t/test_security.t index 97089cdac..7e975ecca 100644 --- a/qa/t/test_security.t +++ b/qa/t/test_security.t @@ -14,7 +14,7 @@ use Test::More "no_plan"; use QA::Util; my ($sel, $config) = get_selenium(CHROME_MODE); -my $urlbase = $config->{bugzilla_installation}; +my $urlbase = $config->{bugzilla_installation}; my $admin_user = $config->{admin_user_login}; # Let's create a bug and attachment to play with. @@ -23,7 +23,7 @@ log_in($sel, $config, 'admin'); file_bug_in_product($sel, "TestProduct"); my $bug_summary = "Security checks"; $sel->type_ok("short_desc", $bug_summary); -$sel->type_ok("comment", "This bug will be used to test security fixes."); +$sel->type_ok("comment", "This bug will be used to test security fixes."); $sel->attach_file('//input[@name="data"]', $config->{attachment_file}); $sel->type_ok('//input[@name="description"]', "simple patch, v1"); my $bug1_id = create_bug($sel, $bug_summary); @@ -35,7 +35,8 @@ my $bug1_id = create_bug($sel, $bug_summary); # No alternate host for attachments; cookies will be accessible. -set_parameters($sel, { "Attachments" => {"allow_attachment_display-on" => undef } }); +set_parameters($sel, + {"Attachments" => {"allow_attachment_display-on" => undef}}); go_to_bug($sel, $bug1_id); $sel->click_ok("link=simple patch, v1"); @@ -45,7 +46,8 @@ my @cookies = split(/[\s;]+/, $sel->get_cookie()); my $nb_cookies = scalar @cookies; ok($nb_cookies, "Found $nb_cookies cookies:\n" . join("\n", @cookies)); ok(!$sel->is_cookie_present("Bugzilla_login"), "Bugzilla_login not accessible"); -ok(!$sel->is_cookie_present("Bugzilla_logincookie"), "Bugzilla_logincookie not accessible"); +ok(!$sel->is_cookie_present("Bugzilla_logincookie"), + "Bugzilla_logincookie not accessible"); $sel->go_back_ok(); $sel->wait_for_page_to_load_ok(WAIT_TIME); $sel->title_like(qr/^$bug1_id /); @@ -85,25 +87,30 @@ my $editbugs_cookie = $sel->get_value("token"); # Using our own unused token is fine. -$sel->open_ok("/$urlbase/userprefs.cgi?tab=settings&dosave=1&display_quips=off&token=$editbugs_cookie"); +$sel->open_ok( + "/$urlbase/userprefs.cgi?tab=settings&dosave=1&display_quips=off&token=$editbugs_cookie" +); $sel->title_is("User Preferences"); -$sel->is_text_present_ok("The changes to your general preferences have been saved"); +$sel->is_text_present_ok( + "The changes to your general preferences have been saved"); # Reusing a token must fail. They must all trigger the Suspicious Action warning. -my @args = ("", "token=", "token=i123x", "token=$admin_cookie", "token=$editbugs_cookie"); +my @args = ("", "token=", "token=i123x", "token=$admin_cookie", + "token=$editbugs_cookie"); foreach my $arg (@args) { - $sel->open_ok("/$urlbase/userprefs.cgi?tab=settings&dosave=1&display_quips=off&$arg"); - $sel->title_is("Suspicious Action"); - - if ($arg eq "token=$admin_cookie") { - $sel->is_text_present_ok("Generated by: QA Admin <$admin_user>"); - $sel->is_text_present_ok("This token has not been generated by you"); - } - else { - $sel->is_text_present_ok("It looks like you didn't come from the right page"); - } + $sel->open_ok( + "/$urlbase/userprefs.cgi?tab=settings&dosave=1&display_quips=off&$arg"); + $sel->title_is("Suspicious Action"); + + if ($arg eq "token=$admin_cookie") { + $sel->is_text_present_ok("Generated by: QA Admin <$admin_user>"); + $sel->is_text_present_ok("This token has not been generated by you"); + } + else { + $sel->is_text_present_ok("It looks like you didn't come from the right page"); + } } logout($sel); @@ -116,8 +123,8 @@ file_bug_in_product($sel, "TestProduct"); $sel->type_ok("alias", "secret_qa_bug_" . ($bug1_id + 1)); my $bug_summary2 = "Private QA Bug"; $sel->type_ok("short_desc", $bug_summary2); -$sel->type_ok("comment", "This private bug is used to test security fixes."); -$sel->type_ok("dependson", $bug1_id); +$sel->type_ok("comment", "This private bug is used to test security fixes."); +$sel->type_ok("dependson", $bug1_id); $sel->check_ok('//input[@name="groups" and @value="Master"]'); my $bug2_id = create_bug($sel, $bug_summary2); @@ -127,12 +134,14 @@ logout($sel); log_in($sel, $config, 'editbugs'); go_to_bug($sel, $bug1_id); -ok(!$sel->is_text_present("secret_qa_bug_$bug2_id"), "The alias 'secret_qa_bug_$bug2_id' is not visible for unauthorized users"); +ok(!$sel->is_text_present("secret_qa_bug_$bug2_id"), + "The alias 'secret_qa_bug_$bug2_id' is not visible for unauthorized users"); $sel->is_text_present_ok($bug2_id); logout($sel); go_to_bug($sel, $bug1_id); -ok(!$sel->is_text_present("secret_qa_bug_$bug2_id"), "The alias 'secret_qa_bug_$bug2_id' is not visible for logged out users"); +ok(!$sel->is_text_present("secret_qa_bug_$bug2_id"), + "The alias 'secret_qa_bug_$bug2_id' is not visible for logged out users"); $sel->is_text_present_ok($bug2_id); ####################################################################### @@ -143,7 +152,8 @@ $sel->is_text_present_ok($bug2_id); ####################################################################### log_in($sel, $config, 'admin'); -set_parameters($sel, { "Attachments" => {"allow_attachment_display-off" => undef} }); +set_parameters($sel, + {"Attachments" => {"allow_attachment_display-off" => undef}}); # Attachments are not viewable. @@ -151,8 +161,10 @@ go_to_bug($sel, $bug1_id); $sel->click_ok("link=Details"); $sel->wait_for_page_to_load_ok(WAIT_TIME); $sel->title_like(qr/Attachment \d+ Details for Bug $bug1_id/); -$sel->is_text_present_ok("The attachment is not viewable in your browser due to security restrictions"); +$sel->is_text_present_ok( + "The attachment is not viewable in your browser due to security restrictions"); $sel->click_ok("link=View"); + # Wait 1 second to give the browser a chance to display the attachment. # Do not use wait_for_page_to_load_ok() as the File Saver will never go away. sleep(1); @@ -161,7 +173,8 @@ ok(!$sel->is_text_present('@@'), "Patch not displayed"); # Enable viewing attachments. -set_parameters($sel, { "Attachments" => {"allow_attachment_display-on" => undef} }); +set_parameters($sel, + {"Attachments" => {"allow_attachment_display-on" => undef}}); go_to_bug($sel, $bug1_id); $sel->click_ok('link=simple patch, v1'); |