Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

Debug v21

Browse Source
This commit is contained in:
Laurent Destailleur (aka Eldy)
2024-12-31 16:56:59 +01:00
parent 3cad54e4d1
commit 4d02eca12a
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
test/phpunit/SecurityGETPOSTTest.php
View File

@@ -126,6 +126,7 @@ class SecurityGETPOSTTest extends CommonClassTest
$_POST["param18"] = '<span style="background-image: url(...?...action=aaa)">abc</span>';
$_POST["param19"] = '<a href="j&Tab;a&Tab;v&Tab;asc&NewLine;ri&Tab;pt:&lpar;alert(document.cookie)&rpar;">XSS</a>';
//$_POST["param19"]='<a href="javascript:alert(document.cookie)">XSS</a>';
$_GET["param20"] = '<link rel="dns-prefetch" href="//cdnjs.cloudflare.com" />';
@@ -415,6 +416,10 @@ class SecurityGETPOSTTest extends CommonClassTest
print __METHOD__." result=".$result."\n";
$this->assertEquals('<span style="background-image: url(...?...aaa)">abc</span>', $result, 'Test anytag with a forbidden value for attribute');
$result = GETPOST("param20", 'restricthtmlallowlinkscript');
print __METHOD__." result param20 = ".$result."\n";
$this->assertEquals('<link rel="dns-prefetch" href="//cdnjs.cloudflare.com">', $result);
unset($conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES);