setScriptUrl('/cacti/include/js/csrf.js'); return $guard; } test('a POST form gets the hidden token field', function () { $guard = csrf_test_rewrite_guard(); $out = $guard->rewriteBuffer("

"); expect($out)->toContain("name='__csrf_magic'"); expect($out)->toMatch('#]*>\s*rewriteBuffer("

"); /* * The head script is injected unconditionally (it also serves pages * whose only POST comes from AJAX, with no

at all), so it * legitimately carries the field name. What must NOT happen is the * hidden field landing inside the GET form itself. */ expect($out)->not->toContain("name='__csrf_magic'"); }); test('the JS globals and script tag are injected into head', function () { $guard = csrf_test_rewrite_guard(); $out = $guard->rewriteBuffer(''); expect($out)->toContain('var csrfMagicToken'); expect($out)->toContain('var csrfMagicName'); expect($out)->toContain('/cacti/include/js/csrf.js'); expect($out)->toContain('CsrfMagic.end();'); }); /* * The JS globals sit inside a '); }); test('a disabled guard does not rewrite', function () { $guard = new CactiCsrfGuard(null, false); $buffer = "

"; expect($guard->rewriteBuffer($buffer))->toBe($buffer); });