Changeset 46497 for branches/4.5/tests/phpunit/tests/auth.php

Timestamp:

10/14/2019 07:06:04 PM (7 years ago)

Author:

whyisjake

Message:

Backporting several bug fixes.

• Query: Remove the static query property.
• HTTP API: Protect against hex interpretation.
• Filesystem API: Prevent directory travelersals when creating new folders.
• Administration: Ensure that admin referer nonce is valid.
• REST API: Send a Vary: Origin header on GET requests.
• Customizer: Properly sanitize background images.

Backports [46474], [46475], [46476], [46477], [46478], [46483], [46485] to the 4.5 branch.

Location:

branches/4.5

Files:

• . (modified) (1 prop)
• tests/phpunit/tests/auth.php (modified) (2 diffs)

branches/4.5/tests/phpunit/tests/auth.php

@@ -142 +142 @@
         }
 
+        public function test_check_admin_referer_with_default_action_as_string_not_doing_it_wrong() {
+                // A valid nonce needs to be set so the check doesn't die()
+                $_REQUEST['_wpnonce'] = wp_create_nonce( '-1' );
+                $result               = check_admin_referer( '-1' );
+                $this->assertSame( 1, $result );
+
+                unset( $_REQUEST['_wpnonce'] );
+        }
+
         /**
          * @ticket 24030
@@ -152 +161 @@
 
                 $this->assertEquals( $count, did_action( $this->nonce_failure_hook ) );
+        }
+
+        /**
+         * @ticket 36361
+         */
+        public function test_check_admin_referer_with_no_action_triggers_doing_it_wrong() {
+                $this->setExpectedIncorrectUsage( 'check_admin_referer' );
+
+                // A valid nonce needs to be set so the check doesn't die()
+                $_REQUEST['_wpnonce'] = wp_create_nonce( -1 );
+                $result = check_admin_referer();
+                $this->assertSame( 1, $result );
+
+                unset( $_REQUEST['_wpnonce'] );
+        }
+
+        /**
+         * @ticket 36361
+         */
+        public function test_check_ajax_referer_with_no_action_triggers_doing_it_wrong() {
+                $this->setExpectedIncorrectUsage( 'check_ajax_referer' );
+
+                // A valid nonce needs to be set so the check doesn't die()
+                $_REQUEST['_wpnonce'] = wp_create_nonce( -1 );
+                $result = check_ajax_referer();
+                $this->assertSame( 1, $result );
+
+                unset( $_REQUEST['_wpnonce'] );
         }