# Copyright 2018 Koha Development Team # # This file is part of Koha. # # Koha is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 3 of the License, or # (at your option) any later version. # # Koha is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with Koha; if not, see . use Modern::Perl; use Test::More tests => 7; use t::lib::QA::TemplateFilters; subtest 'Asset must use raw' => sub { plan tests => 2; my $input = < "asset_must_be_raw", line => '[% Asset.css("css/one.css") %]', line_number => 1, }, { error => "asset_must_be_raw", line => '[% Asset.css("js/two.js") %]', line_number => 2, } ], ); }; subtest 'Variables must be html escaped' => sub { plan tests => 2; my $input = <Koha › Patrons › [% UNLESS blocking_error %] [% just_a_var %] [% just_a_var %] A N D [% another_one_on_same_line %] [% END %] [% IF ( patron.othernames ) %]“[% patron.othernames %]”[% END %] [% patron_message.get_column('manager_surname') %] INPUT my $expected = <Koha › Patrons › [% UNLESS blocking_error %] [% just_a_var | html %] [% just_a_var | html %] A N D [% another_one_on_same_line | html %] [% END %] [% IF ( patron.othernames ) %]“[% patron.othernames | html %]”[% END %] [% patron_message.get_column('manager_surname') | html %] EXPECTED my $new_content = t::lib::QA::TemplateFilters::fix_filters($input); is( $new_content . "\n", $expected, ); my @missing_filters = t::lib::QA::TemplateFilters::missing_filters($input); is_deeply( \@missing_filters, [{ error => "missing_filter", line => " [% just_a_var %]", line_number => 3, }, { error => "missing_filter", line => " [% just_a_var %] A N D [% another_one_on_same_line %]", line_number => 4, }, { error => "missing_filter", line => " [% just_a_var %] A N D [% another_one_on_same_line %]", line_number => 4, }, { error => "missing_filter", line => " [% IF ( patron.othernames ) %]“[% patron.othernames %]”[% END %]", line_number => 6, }, { error => "missing_filter", line => "[% patron_message.get_column('manager_surname') %]", line_number => 8 } ], ); }; subtest 'TT directives, assignments and already filtered variables must not be escaped' => sub { plan tests => 2; my $input = < sub { plan tests => 1; my $input = < sub { plan tests => 4; my $input = <[% patron.phone %] [% patron.emailpro %] [% patron.emailpro %] [% patron.emailpro %] [% myuri %] [% myuri %] [% myurl %] [% myurl %] [% myurl %] [% another_var %] [% patron.phone | html %] [% patron.emailpro | html %] [% patron.emailpro | html %] [% patron.emailpro | html %] [% myuri | html %] [% myuri | html %] [% myurl | html %] [% myurl | html %] [% myurl | html %] [% another_var | html %] [% var | html %] INPUT my @missing_filters = t::lib::QA::TemplateFilters::missing_filters($input); is_deeply( \@missing_filters, [ { error => "wrong_html_filter", line => '[% var | html %]', line_number => 1 } ], ); $input = <[% var | html %] INPUT @missing_filters = t::lib::QA::TemplateFilters::missing_filters($input); is_deeply( \@missing_filters, [], ); $input = <[% var | html %] INPUT @missing_filters = t::lib::QA::TemplateFilters::missing_filters($input); is_deeply( \@missing_filters, [], 'html_entity is a valid filter for href' ); }; subtest 'Do not escape KohaDates|Prices|HtmlTags output' => sub { plan tests => 2; my $input = < 1 %] [% var | \$KohaDates | html %] [% var | \$KohaDates with_hours => 1 | html %] [% var | \$Price %] [% var | \$HtmlTags %] INPUT my $expected = < 1 %] [% var | \$KohaDates %] [% var | \$KohaDates with_hours => 1 %] [% var | \$Price %] [% var | \$HtmlTags %] EXPECTED my $new_content = t::lib::QA::TemplateFilters::fix_filters($input); is( $new_content . "\n", $expected, ); my @missing_filters = t::lib::QA::TemplateFilters::missing_filters($input); is_deeply( \@missing_filters, [ { error => "extra_filter_not_needed", line => "[% var | \$KohaDates | html %]", line_number => 3, }, { error => "extra_filter_not_needed", line => "[% var | \$KohaDates with_hours => 1 | html %]", line_number => 4, } ] ); }; subtest 'Do not escape TT methods' => sub { plan tests => 2; my $input = <