Skip to content
This repository was archived by the owner on Apr 29, 2019. It is now read-only.

Commit 349ec44

Browse files
DianaRusinDianaRusin
committed
MAGETWO-85139: Cross-Site Request Forgery (Backups, maintenance mode) - Magento 1 & 2
1 parent b335359 commit 349ec44

File tree

2 files changed

+256
-2
lines changed

2 files changed

+256
-2
lines changed

‎app/code/Magento/Backup/Controller/Adminhtml/Index/Create.php

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,14 @@
1212
class Create extends \Magento\Backup\Controller\Adminhtml\Index
1313
{
1414
/**
15-
* Create backup action
15+
* Create backup action.
1616
*
1717
* @return void|\Magento\Backend\App\Action
1818
* @SuppressWarnings(PHPMD.CyclomaticComplexity)
1919
*/
2020
public function execute()
2121
{
22-
if (!$this->getRequest()->isAjax()) {
22+
if (!$this->requestAllowed()) {
2323
return $this->_redirect('*/*/index');
2424
}
2525

@@ -106,4 +106,14 @@ public function execute()
106106

107107
$this->getResponse()->representJson($response->toJson());
108108
}
109+
110+
/**
111+
* Check if request is allowed.
112+
*
113+
* @return bool
114+
*/
115+
private function requestAllowed()
116+
{
117+
return $this->getRequest()->isAjax() && $this->getRequest()->isPost();
118+
}
109119
}

‎app/code/Magento/Backup/Test/Unit/Controller/Adminhtml/Index/CreateTest.php

Lines changed: 244 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,244 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
namespace Magento\Backup\Test\Unit\Controller\Adminhtml\Index;
7+
8+
use Magento\Framework\TestFramework\Unit\Helper\ObjectManager;
9+
10+
/**
11+
* Tests \Magento\Backup\Controller\Adminhtml\Index\Create class.
12+
*
13+
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
14+
*/
15+
class CreateTest extends \PHPUnit\Framework\TestCase
16+
{
17+
/**
18+
* @var \Magento\Framework\TestFramework\Unit\Helper\ObjectManager
19+
*/
20+
private $objectManager;
21+
22+
/**
23+
* @var \Magento\Backend\App\Action\Context
24+
*/
25+
private $context;
26+
27+
/**
28+
* @var \Magento\Framework\ObjectManagerInterface|\PHPUnit_Framework_MockObject_MockObject
29+
*/
30+
private $objectManagerMock;
31+
32+
/**
33+
* @var \Magento\Framework\App\RequestInterface|\PHPUnit_Framework_MockObject_MockObject
34+
*/
35+
private $requestMock;
36+
37+
/**
38+
* @var \Magento\Framework\App\ResponseInterface|\PHPUnit_Framework_MockObject_MockObject
39+
*/
40+
private $responseMock;
41+
42+
/**
43+
* @var \Magento\Backup\Model\Backup|\PHPUnit_Framework_MockObject_MockObject
44+
*/
45+
private $backupModelMock;
46+
47+
/**
48+
* @var \Magento\Backend\Helper\Data|\PHPUnit_Framework_MockObject_MockObject
49+
*/
50+
private $dataBackendHelperMock;
51+
52+
/**
53+
* @var \Magento\Backup\Helper\Data|\PHPUnit_Framework_MockObject_MockObject
54+
*/
55+
private $dataBackupHelperMock;
56+
57+
/**
58+
* @var \Magento\Framework\App\Response\Http\FileFactory|\PHPUnit_Framework_MockObject_MockObject
59+
*/
60+
private $fileFactoryMock;
61+
62+
/**
63+
* @var \Magento\Backend\Model\Session|\PHPUnit_Framework_MockObject_MockObject
64+
*/
65+
private $sessionMock;
66+
67+
/**
68+
* @var \Magento\Framework\App\MaintenanceMode|\PHPUnit_Framework_MockObject_MockObject
69+
*/
70+
private $maintenanceMode;
71+
72+
/**
73+
* @var \Magento\Framework\Backup\Factory|\PHPUnit_Framework_MockObject_MockObject
74+
*/
75+
private $backupFactoryMock;
76+
77+
/**
78+
* @var \Magento\Backup\Controller\Adminhtml\Index\Create|\PHPUnit_Framework_MockObject_MockObject
79+
*/
80+
private $createController;
81+
82+
public function setUp()
83+
{
84+
$this->objectManagerMock = $this->getMockBuilder(\Magento\Framework\ObjectManagerInterface::class)
85+
->getMock();
86+
$this->requestMock = $this->getMockBuilder(\Magento\Framework\App\Request\Http::class)
87+
->disableOriginalConstructor()
88+
->setMethods(['isAjax', 'isPost', 'getParam'])
89+
->getMock();
90+
$this->responseMock = $this->getMockBuilder(\Magento\Framework\App\Response\Http::class)
91+
->disableOriginalConstructor()
92+
->setMethods(['representJson', 'setRedirect'])
93+
->getMock();
94+
$this->sessionMock = $this->getMockBuilder(\Magento\Backend\Model\Session::class)
95+
->disableOriginalConstructor()
96+
->getMock();
97+
$this->backupFactoryMock = $this->getMockBuilder(\Magento\Framework\Backup\Factory::class)
98+
->disableOriginalConstructor()
99+
->setMethods(['create'])
100+
->getMock();
101+
$this->backupModelMock = $this->getMockBuilder(\Magento\Backup\Model\Backup::class)
102+
->disableOriginalConstructor()
103+
->setMethods(['setBackupExtension', 'setTime', 'setBackupsDir', 'setName', 'create'])
104+
->getMock();
105+
$this->dataBackendHelperMock = $this->getMockBuilder(\Magento\Backend\Helper\Data::class)
106+
->disableOriginalConstructor()
107+
->setMethods(['getUrl'])
108+
->getMock();
109+
$this->dataBackupHelperMock = $this->getMockBuilder(\Magento\Backup\Helper\Data::class)
110+
->disableOriginalConstructor()
111+
->setMethods(['getExtensionByType', 'getBackupsDir'])
112+
->getMock();
113+
$this->maintenanceMode = $this->getMockBuilder(\Magento\Framework\App\MaintenanceMode::class)
114+
->disableOriginalConstructor()
115+
->setMethods(['set'])
116+
->getMock();
117+
$this->fileFactoryMock = $this->getMockBuilder(\Magento\Framework\App\Response\Http\FileFactory::class)
118+
->disableOriginalConstructor()
119+
->getMock();
120+
$this->objectManager = new ObjectManager($this);
121+
$this->context = $this->objectManager->getObject(
122+
\Magento\Backend\App\Action\Context::class,
123+
[
124+
'objectManager' => $this->objectManagerMock,
125+
'request' => $this->requestMock,
126+
'response' => $this->responseMock,
127+
'session' => $this->sessionMock,
128+
'helper' => $this->dataBackendHelperMock,
129+
'maintenanceMode' => $this->maintenanceMode,
130+
]
131+
);
132+
$this->createController = $this->objectManager->getObject(
133+
\Magento\Backup\Controller\Adminhtml\Index\Create::class,
134+
[
135+
'context' => $this->context,
136+
'backupFactory' => $this->backupFactoryMock,
137+
'fileFactory' => $this->fileFactoryMock,
138+
]
139+
);
140+
}
141+
142+
/**
143+
* @covers \Magento\Backup\Controller\Adminhtml\Index\Create::execute
144+
* @return void
145+
*/
146+
public function testExecuteNotPost()
147+
{
148+
$redirectUrl = '*/*/index';
149+
$redirectUrlBackup = 'backup/index/index';
150+
151+
$this->requestMock->expects($this->any())
152+
->method('isAjax')
153+
->willReturn(true);
154+
$this->requestMock->expects($this->any())
155+
->method('isPost')
156+
->willReturn(false);
157+
$this->requestMock->expects($this->any())
158+
->method('getParam')
159+
->with('maintenance_mode')
160+
->willReturn(true);
161+
$this->dataBackendHelperMock->expects($this->any())
162+
->method('getUrl')
163+
->with($redirectUrl, [])
164+
->willReturn($redirectUrlBackup);
165+
$this->responseMock->expects($this->any())
166+
->method('setRedirect')
167+
->with($redirectUrlBackup)
168+
->willReturnSelf();
169+
170+
$this->assertSame($this->responseMock, $this->createController->execute());
171+
}
172+
173+
/**
174+
* @covers \Magento\Backup\Controller\Adminhtml\Index\Create::execute
175+
* @return void
176+
*/
177+
public function testExecutePermission()
178+
{
179+
$redirectUrl = '*/*/index';
180+
$redirectUrlBackup = 'backup/index/index';
181+
$backupType = 'db';
182+
$backupName = 'backup1';
183+
$response = '{"redirect_url":"backup\/index\/index"}';
184+
185+
$this->requestMock->expects($this->any())
186+
->method('isAjax')
187+
->willReturn(true);
188+
$this->requestMock->expects($this->any())
189+
->method('isPost')
190+
->willReturn(true);
191+
$this->requestMock->expects($this->any())
192+
->method('getParam')
193+
->willReturnMap([
194+
['type', null, $backupType],
195+
['backup_name', null, $backupName],
196+
]);
197+
$this->dataBackendHelperMock->expects($this->any())
198+
->method('getUrl')
199+
->with($redirectUrl, [])
200+
->willReturn($redirectUrlBackup);
201+
$this->responseMock->expects($this->any())
202+
->method('representJson')
203+
->with($response)
204+
->willReturnSelf();
205+
$this->maintenanceMode->expects($this->any())
206+
->method('set')
207+
->with(true)
208+
->willReturn(false);
209+
$this->backupFactoryMock->expects($this->any())
210+
->method('create')
211+
->with($backupType)
212+
->willReturn($this->backupModelMock);
213+
$this->backupModelMock->expects($this->any())
214+
->method('setBackupExtension')
215+
->with($backupType)
216+
->willReturnSelf();
217+
$this->backupModelMock->expects($this->any())
218+
->method('setBackupsDir')
219+
->willReturnSelf();
220+
$this->backupModelMock->expects($this->any())
221+
->method('setTime')
222+
->willReturnSelf();
223+
$this->backupModelMock->expects($this->any())
224+
->method('setName')
225+
->with($backupName)
226+
->willReturnSelf();
227+
$this->backupModelMock->expects($this->once())
228+
->method('create')
229+
->willReturnSelf();
230+
$this->objectManagerMock->expects($this->any())
231+
->method('get')
232+
->with(\Magento\Backup\Helper\Data::class)
233+
->willReturn($this->dataBackupHelperMock);
234+
$this->dataBackupHelperMock->expects($this->any())
235+
->method('getExtensionByType')
236+
->with($backupType)
237+
->willReturn($backupType);
238+
$this->dataBackupHelperMock->expects($this->any())
239+
->method('getBackupsDir')
240+
->willReturn('dir');
241+
242+
$this->assertNull($this->createController->execute());
243+
}
244+
}

0 commit comments

Comments
 (0)