From 71abfbffcb5c784a85589aaff02f9ab7ef4c93bc Mon Sep 17 00:00:00 2001
From: Ian Jackson <ian.jackson@eu.citrix.com>
Date: Tue, 27 Oct 2015 18:51:03 +0000
Subject: [PATCH] Testing: Fix up $url management

We need to handle the incoming URL more subtly in tests/cgi so that
the tail of the path is preserved; the existing approach squashes it
for the purposes of the CAF get_url callback, but fails to sanitise
the URL at all for the purposes of tests/cgi's form generation.

It would be best if there were a way in the CGI specification for w3m
to tell the script that its own url is actually file:///something, so
that CGI(3pm)'s url method would DTRT.  But there isn't.

In the absence of any useful information provided by w3m, CGI makes up
`http://localhost', which is fair enough.  We can simply replace that
with our own URL prefix.

So we replace the CAFTEST_URL variable with CAFTEST_URLBASE, which
contains the start of the URL (not including the path part, which
tests/cgi can get out of $q->url, and which we would have difficulty
dismantling and reassembling anyway).

In tests/cgi, we apply this to $url if CAFTEST_URLBASE is set, and
then we can unconditionally supply a get_url hook (which hook is
equivalent to the default one if $url wasn't modified).

Adjusting $url in tests/cgi makes the form field come out with the
right URL.  And the new adjustment scheme means that invocations with
a nonempty PATH_INFO do not lose the PATH_INFO.

Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
---
 tests/cgi  | 20 +++++++++++---------
 tests/wrap |  2 +-
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/tests/cgi b/tests/cgi
index 6af2413..b73e6aa 100755
--- a/tests/cgi
+++ b/tests/cgi
@@ -12,6 +12,13 @@ $SIG{__DIE__} = sub { Carp::confess(@_) };
 
 my $dump = "$ENV{'CAFTEST_CAF'}/tests/tmp";
 
+my $q = CGI->new;
+
+my $url = $q->url();
+
+$url =~ s{^\Qhttp://localhost/\E}{$ENV{CAFTEST_URLBASE}}
+    if $ENV{'CAFTEST_URLBASE'};
+
 my @verifier_params =(
     username_password_error => sub {
         my ($c,$r,$u,$p)=@_;
@@ -22,24 +29,18 @@ my @verifier_params =(
     dir => $dump,
     srcdump_filter_cwd => 0,
     debug => sub { print STDERR "DEBUG ", @_[2..@_-1]; },
-    );
-
-push @verifier_params, (
-    get_url => sub { return $ENV{'CAFTEST_URL'}; },
-    ) if $ENV{'CAFTEST_URL'};
+    get_url => sub { return $url },
+);
 
 my $verifier = CGI::Auth::Flexible->new_verifier(@verifier_params);
 
 END { $verifier->disconnect() if $verifier; }
 
-my $q = CGI->new;
-
 my $authreq = $verifier->new_request($q);
 
 $authreq->check_ok() or exit;
 
 my $cookie = $authreq->secret_cookie();
-my $url = $q->url();
 my $hiddenhtml = $authreq->secret_hidden_html();
 
 print <<END;
@@ -57,7 +58,8 @@ END
 my $newurl = $authreq->url_with_query_params($authreq->chain_params());
 my $newurl_esc = escapeHTML($newurl);
 
-my $txt = Data::Dumper->Dump([$authreq->get_username(), $authreq->mutate_ok(),
+my $txt = Data::Dumper->Dump([$authreq->get_username(),
+ $q->request_method eq 'POST' ? $authreq->check_mutate() : "(not POST)",
                               $q->path_info(),
                               $authreq->chain_params(),
                               scalar $q->Vars()],
diff --git a/tests/wrap b/tests/wrap
index fefbef4..c401f57 100755
--- a/tests/wrap
+++ b/tests/wrap
@@ -3,7 +3,7 @@ set -e
 cd "$CAFTEST_CAF"
 exec 2>>tests/tmp/wrap.log
 export HTTP_COOKIE=$(cat "tests/tmp/cookie")
-export CAFTEST_URL=file:///cgi-bin/wrap
+export CAFTEST_URLBASE=file:///
 tests/cgi "$@" | perl -pe '
     next if m/^$/..0;
     next unless m/Set-Cookie: (\w+=[^; ]+)/;
-- 
2.30.2