mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-07-31 14:00:31 +02:00
Code Issues Releases Wiki Activity

[ticket/security-250] Check form key when approving group membership

Browse Source 
SECURITY-250
This commit is contained in:
Marc Alexander
2019-12-24 12:44:16 +01:00
parent 3aa4b67173
commit 4f007321e1
3 changed files with 94 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

68
tests/functional/ucp_groups_test.php
View File

@@ -54,4 +54,72 @@ class phpbb_functional_ucp_groups_test extends phpbb_functional_common_groups_te
$this->assertContains($this->lang('GROUP_UPDATED'), $crawler->text());
$this->assertEquals($teampage_settings, $this->get_teampage_settings());
}
public function test_create_request_group()
{
$this->login();
$this->admin_login();
$this->add_lang('acp/groups');
$crawler = self::request('GET', 'adm/index.php?i=acp_groups&mode=manage&sid=' . $this->sid);
$form = $crawler->selectButton($this->lang('SUBMIT'))->form();
$crawler = self::submit($form, array('group_name' => 'request-group'));
$form = $crawler->selectButton($this->lang('SUBMIT'))->form();
$crawler = self::submit($form, array('group_name' => 'request-group'));
$this->assertContainsLang('GROUP_CREATED', $crawler->filter('#main')->text());
$group_id = $this->get_group_id('request-group');
// Make admin group leader
$crawler = self::request('GET', 'adm/index.php?i=acp_groups&mode=manage&action=list&g=' . $group_id . '&sid=' . $this->sid);
$form = $crawler->filter('input[name=addusers]')->selectButton($this->lang('SUBMIT'))->form();
$crawler = self::submit($form, [
'leader' => 1,
'usernames' => 'admin',
]);
$this->assertContainsLang('GROUP_MODS_ADDED', $crawler->filter('#main')->text());
}
/**
* @depends test_create_request_group
*/
public function test_request_group_membership()
{
$this->create_user('request-group-user');
$this->login('request-group-user');
$this->add_lang('groups');
$group_id = $this->get_group_id('request-group');
$crawler = self::request('GET', 'ucp.php?i=ucp_groups&mode=membership&sid=' . $this->sid);
$form = $crawler->selectButton($this->lang('SUBMIT'))->form();
$crawler = self::submit($form, ['selected' => $group_id, 'action' => 'join']);
$this->assertContainsLang('GROUP_JOIN_PENDING_CONFIRM', $crawler->text());
$form = $crawler->selectButton($this->lang('YES'))->form();
$crawler = self::submit($form);
$this->assertContainsLang('GROUP_JOINED_PENDING', $crawler->text());
}
/**
* @depends test_request_group_membership
*/
public function test_approve_group_membership()
{
$this->login();
$this->add_lang('acp/groups');
$group_id = $this->get_group_id('request-group');
$crawler = self::request('GET', 'ucp.php?i=ucp_groups&mode=manage&action=list&g=' . $group_id . '&sid=' . $this->sid);
$form = $crawler->filter('input[name=update]')->selectButton($this->lang('SUBMIT'))->form();
$crawler = self::submit($form, [
'mark' => [$crawler->filter('input[name="mark[]"]')->first()->attr('value')],
'action' => 'approve',
]);
$this->assertContainsLang('USERS_APPROVED', $crawler->text());
}
}