mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-28 23:57:30 +09:00
TheWitness
7b551eea72
Excludes vendored packages, third-party JS, patches, and the Win32 probe fixture. Pure EOL change; guards pass and php -l is clean.
26 lines
1004 B
PHP
26 lines
1004 B
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
/*
|
|
* Remember-me session hardening: the nopassword change path must revoke the
|
|
* server-side remember-me row, not just the browser cookie (GHSA-cg45), and
|
|
* the remember-me token check must enforce a retention window instead of
|
|
* trusting the cron purge alone (GHSA-xq26).
|
|
*/
|
|
|
|
$root = dirname(__DIR__, 4);
|
|
|
|
test('nopassword change revokes the server-side remember-me row (GHSA-cg45)', function () use ($root) {
|
|
$s = file_get_contents($root . '/auth_changepassword.php');
|
|
expect($s)->toContain('clear_auth_cookie()');
|
|
});
|
|
|
|
test('remember-me token check enforces a retention window (GHSA-xq26)', function () use ($root) {
|
|
$s = file_get_contents($root . '/lib/auth.php');
|
|
expect($s)->toContain('AND last_update >= DATE_SUB(NOW(), INTERVAL 90 DAY)');
|
|
});
|