summaryrefslogtreecommitdiff
path: root/rt/t/security/CVE-2011-4458-verp.t
blob: f84b79403a1019283bb1dc1f9ddf1f9cbde6a5f6 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
use strict;
use warnings;

use RT::Test tests => undef;

RT->Config->Set( MailCommand  => 'sendmailpipe' );
RT->Config->Set( VERPPrefix   => "verp-" );
RT->Config->Set( VERPDomain   => "example.com" );

# Ensure that the fake sendmail knows where to write to
$ENV{RT_MAILLOGFILE} = RT::Test->temp_directory . "/sendmailpipe.log";
my $fake = File::Spec->rel2abs( File::Spec->catfile(
        't', 'security', 'fake-sendmail' ) );
RT->Config->Set( SendmailPath => $fake);

ok(
    RT::Test->set_rights(
        { Principal => 'Everyone',  Right => [qw/CreateTicket/] },
    ),
    'set rights'
);

my $bad = RT::Test->load_or_create_user(
    EmailAddress => 'danger-$USER@example.com',
);
ok( $bad, "Got a user object back" );
ok( $bad->id, "Successfully created a user" );

my $current_user = RT::CurrentUser->new(RT->SystemUser);
my ($id, $msg) = $current_user->Load($bad->Id);
ok( $id, "Loaded the user successfully" );

my $ticket = RT::Ticket->new( $current_user );
($id, $msg) = $ticket->Create(
    Requestor => $bad->Id,
    Subject   => "Danger, Will Robinson!",
    Queue     => "General"
);
ok( $id, "Created a ticket: $msg" );

open(LOG, "<", $ENV{RT_MAILLOGFILE}) or die "Can't open log file: $!";
while (my $line = <LOG>) {
    next unless $line =~ /^-f/;
    like($line, qr/\$USER/, "Contains uninterpolated \$USER");
}
close(LOG);

done_testing;