mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-27 07:13:15 +09:00
Thomas VincentandTheWitness
157a4458ae
* fix(auth): reject malformed remember cookies Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test: load cookie contracts lazily * test(cookie): fail clearly when contract markers move Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(auth): align persistent credential lifecycle Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test(auth): find cookie function boundaries robustly Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Co-authored-by: TheWitness <thewitness@cacti.net>
49 lines
1.7 KiB
PHP
49 lines
1.7 KiB
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
| |
|
|
| This program is free software; you can redistribute it and/or |
|
|
| modify it under the terms of the GNU General Public License |
|
|
| as published by the Free Software Foundation; either version 2 |
|
|
+-------------------------------------------------------------------------+
|
|
| Cacti: The Complete RRDTool-based Graphing Solution |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
test('remember-me cookie runtime records session intent and logout clears browser state', function () : void {
|
|
global $config;
|
|
|
|
$old_config = $config;
|
|
$old_cookie = $_COOKIE;
|
|
$old_session = $_SESSION;
|
|
|
|
try {
|
|
$config[COOKIE_OPTIONS] = [COOKIE_OPTIONS_DOMAIN => 'example.test'];
|
|
$config[CACTI_SESSION_NAME] = 'Cacti';
|
|
$otp_cookie = (string) session_name() . '_otp';
|
|
$_SESSION = [];
|
|
$_COOKIE = [
|
|
'Cacti' => 'session-id',
|
|
$otp_cookie => 'otp-token',
|
|
'cacti_remembers' => '42,-1,secret',
|
|
];
|
|
|
|
cacti_cookie_set('arbitrary', 'value', time() + 60);
|
|
cacti_cookie_session_set('42', -1, 'secret');
|
|
|
|
expect($_SESSION['cacti_remembers'])->toBeTrue();
|
|
|
|
cacti_cookie_session_logout();
|
|
cacti_cookie_logout();
|
|
|
|
expect($_COOKIE)->not->toHaveKey('Cacti')
|
|
->not->toHaveKey($otp_cookie)
|
|
->not->toHaveKey('cacti_remembers');
|
|
} finally {
|
|
$config = $old_config;
|
|
$_COOKIE = $old_cookie;
|
|
$_SESSION = $old_session;
|
|
}
|
|
});
|