Spaces:
No application file
No application file
File size: 2,352 Bytes
d2897cd |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 |
<?php
declare(strict_types=1);
namespace Mautic\UserBundle\Tests\Functional\Controller;
use Mautic\CoreBundle\Test\MauticMysqlTestCase;
class PublicControllerTest extends MauticMysqlTestCase
{
/**
* Tests to ensure that xss is prevented on password reset page.
*/
public function testXssFilterOnPasswordReset(): void
{
$this->client->request('GET', '/passwordreset?bundle=%27-alert("XSS%20TEST%20Mautic")-%27');
$clientResponse = $this->client->getResponse();
$this->assertSame(200, $clientResponse->getStatusCode(), 'Return code must be 200.');
$responseData = $clientResponse->getContent();
// Tests that actual string is not present.
$this->assertStringNotContainsString('-alert("xss test mautic")-', $responseData, 'XSS injection attempt is filtered.');
// Tests that sanitized string is passed.
$this->assertStringContainsString('alertxsstestmautic', $responseData, 'XSS sanitized string is present.');
}
public function testPasswordResetPage(): void
{
$this->client->request('GET', '/passwordreset');
$clientResponse = $this->client->getResponse();
$this->assertSame(200, $clientResponse->getStatusCode(), 'Return code must be 200.');
$responseData = $clientResponse->getContent();
$this->assertStringContainsString('Enter either your username or email to reset your password. Instructions to reset your password will be sent to the email in your profile.', $responseData);
}
public function testPasswordResetAction(): void
{
$crawler = $this->client->request('GET', '/passwordreset');
$saveButton = $crawler->selectButton('reset password');
$form = $saveButton->form();
$form['passwordreset[identifier]']->setValue('[email protected]');
$crawler = $this->client->submit($form);
$clientResponse = $this->client->getResponse();
$this->assertTrue($clientResponse->isOk(), $clientResponse->getContent());
$responseData = $clientResponse->getContent();
$this->assertStringContainsString('A new password has been generated and will be emailed to you, if this user exists. If you do not receive it within a few minutes, check your spam box and/or contact the system administrator.', $responseData);
}
}
|