4b76bc5b32
* Use a HMAC to sign and validate CSRF tokens, instead of generating random ones and storing them in the session data. Reduces number of writes to sessions table and fixes kanboard issue #4942. * Added missing CSRF check for starting/stopping subtask timers. Co-authored-by: Willemijn Coene <willemijn@irdc.nl>
31 lines
668 B
PHP
31 lines
668 B
PHP
<?php
|
|
|
|
require_once __DIR__.'/../../Base.php';
|
|
|
|
use Kanboard\Core\Security\Token;
|
|
|
|
class TokenTest extends Base
|
|
{
|
|
public function testGenerateToken()
|
|
{
|
|
$t1 = Token::getToken();
|
|
$t2 = Token::getToken();
|
|
|
|
$this->assertNotEmpty($t1);
|
|
$this->assertNotEmpty($t2);
|
|
|
|
$this->assertNotEquals($t1, $t2);
|
|
}
|
|
|
|
public function testCSRFTokens()
|
|
{
|
|
$token = new Token($this->container);
|
|
|
|
$csrf = $token->getCSRFToken();
|
|
$this->assertTrue($token->validateCSRFToken($csrf));
|
|
|
|
$pcsrf = $token->getReusableCSRFToken();
|
|
$this->assertTrue($token->validateReusableCSRFToken($pcsrf));
|
|
}
|
|
}
|