fixed added functional test for mobile, added gadget tests (refs #1746)

tejimaya · Sep 21, 2011 · 9292c3b · 9292c3b
1 parent 91ae0b8
commit 9292c3b
Show file tree

Hide file tree

Showing 7 changed files with 158 additions and 1 deletion.
diff --git a/test/fixtures/001_import_member.yml b/test/fixtures/001_import_member.yml
@@ -1,7 +1,7 @@
 Member:
   first_member:
     id: 1
-    name: "A"
+    name: "<&\"'>Member.name ESCAPING HTML TEST DATA"
     is_active: 1
 
   second_member:
@@ -24,3 +24,13 @@ MemberConfig:
     name: "password"
     value: <?php echo md5('password') . "\n"; ?>
     Member: first_member
+
+  third_member_member_config_pc_address:
+    name: "pc_address"
+    value: "sns3@example.com"
+    Member: third_member
+
+  third_member_member_config_password:
+    name: "password"
+    value: <?php echo md5('password') . "\n"; ?>
+    Member: third_member
diff --git a/test/fixtures/002_import_favorite.yml b/test/fixtures/002_import_favorite.yml
@@ -2,3 +2,6 @@ Favorite:
   first_member_favorite:
     Member: third_member
     Member_2: first_member
+  third_member_favorite:
+    Member: first_member
+    Member_2: third_member
diff --git a/test/fixtures/003_import_sns_config.yml b/test/fixtures/003_import_sns_config.yml
@@ -0,0 +1,4 @@
+SnsConfig:
+  is_check_mobile_ip:
+    name: "is_check_mobile_ip"
+    value: 0
diff --git a/test/fixtures/004_import_blog_rss_cache.yml b/test/fixtures/004_import_blog_rss_cache.yml
@@ -0,0 +1,15 @@
+<?php if (class_exists('BlogRssCache')): ?>
+Gadget:
+  favorite_blog_news:
+    type: "contents"
+    name: "favoriteBlogNews"
+    sort_order: 10
+
+BlogRssCache:
+  first_member_blog_rss_cache:
+    Member: third_member
+    title: "<&\"'>BlogRssCache.title ESCAPING HTML TEST DATA"
+    description: "description"
+    link: "http://localhost/"
+    date: <?php echo date("Y-m-d H:i:s\n") ?>
+<?php endif ?>
diff --git a/test/fixtures/005_import_diary.yml b/test/fixtures/005_import_diary.yml
@@ -0,0 +1,17 @@
+<?php if (class_exists('Diary')): ?>
+Gadget:
+  favorite_diary_news:
+    type: "contents"
+    name: "favoriteDiaryNews"
+    sort_order: 20
+  mobile_favorite_diary_news:
+    type: "mobileContents"
+    name: "favoriteDiaryNews"
+    sort_order: 20
+
+Diary:
+  first_member_diary:
+    Member: first_member
+    title: "<&\"'>Diary.title ESCAPING HTML TEST DATA"
+    body: "body"
+<?php endif ?>
diff --git a/test/functional/mobile_frontend/favoriteActionsTest.php b/test/functional/mobile_frontend/favoriteActionsTest.php
@@ -0,0 +1,62 @@
+<?php
+
+/**
+ * This file is part of the OpenPNE package.
+ * (c) OpenPNE Project (http://www.openpne.jp/)
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file and the NOTICE file that were distributed with this source code.
+ */
+
+include dirname(__FILE__).'/../../bootstrap/functional.php';
+include dirname(__FILE__).'/../../bootstrap/database.php';
+
+$browser = new opTestFunctional(new opBrowser(), new lime_test(null, new lime_output_color()));
+$browser->setMobile();
+$browser
+  ->info('Login')
+  ->login('sns@example.com', 'password')
+  ->isStatusCode(302)
+
+// CSRF
+  ->info('/favorite/add?id=2 - CSRF')
+  ->get('/favorite/add?id=2')
+  ->checkCSRF()
+
+  ->info('/favorite/delete/2 - CSRF')
+  ->get('/favorite/delete/2')
+  ->checkCSRF()
+
+// XSS
+  ->info('/favorite/list - XSS')
+  ->get('/favorite/list')
+  ->with('html_escape')->begin()
+    ->isAllEscapedData('Member', 'name')
+  ->end()
+;
+
+if (class_exists('Diary'))
+{
+echo  $browser
+    ->info('Login')
+    ->login('sns3@example.com', 'password')
+    ->isStatusCode(302)
+
+    ->info('/ diary gadget - XSS')
+    ->get('/')
+    ->getResponse()->getContent()
+/*
+    ->with('html_escape')->begin()
+      ->isAllEscapedData('Member', 'name')
+      ->countEscapedData(1, 'Diary', 'title', array('width' => 28))
+    ->end()
+
+    ->info('/favorite/diary gadget - XSS')
+    ->get('/favorite/diary')
+    ->with('html_escape')->begin()
+      ->isAllEscapedData('Member', 'name')
+      ->countEscapedData(1, 'Diary', 'title', array('width' => 28))
+    ->end()
+*/
+  ;
+}
diff --git a/test/functional/pc_frontend/favoriteActionsTest.php b/test/functional/pc_frontend/favoriteActionsTest.php
@@ -39,3 +39,49 @@
     ->isAllEscapedData('Member', 'name')
   ->end()
 ;
+
+if (class_exists('BlogRssCache'))
+{
+  $browser
+    ->info('Login')
+    ->login('sns@example.com', 'password')
+    ->isStatusCode(302)
+
+    ->info('/ blog gadget - XSS')
+    ->get('/')
+    ->with('html_escape')->begin()
+      ->isAllEscapedData('Member', 'name')
+      ->countEscapedData(1, 'BlogRssCache', 'title', array('width' => 30))
+    ->end()
+
+    ->info('/favorite/blog gadget - XSS')
+    ->get('/favorite/blog')
+    ->with('html_escape')->begin()
+      ->isAllEscapedData('Member', 'name')
+      ->isAllEscapedData('BlogRssCache', 'title')
+    ->end()
+  ;
+}
+
+if (class_exists('Diary'))
+{
+  $browser
+    ->info('Login')
+    ->login('sns3@example.com', 'password')
+    ->isStatusCode(302)
+
+    ->info('/ diary gadget - XSS')
+    ->get('/')
+    ->with('html_escape')->begin()
+      ->isAllEscapedData('Member', 'name')
+      ->countEscapedData(1, 'Diary', 'title', array('width' => 30))
+    ->end()
+
+    ->info('/favorite/diary gadget - XSS')
+    ->get('/favorite/diary')
+    ->with('html_escape')->begin()
+      ->isAllEscapedData('Member', 'name')
+      ->countEscapedData(1, 'Diary', 'title', array('width' => 36))
+    ->end()
+  ;
+}