summaryrefslogtreecommitdiff
path: root/rt/t/security/CVE-2011-5093-execute-code.t
blob: 5124ab88bdc4ce956ba6f59968357ec485216da1 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
use strict;
use warnings;

use RT::Test tests => undef;

my $template = RT::Template->new( RT->SystemUser );
my ($ok, $msg) = $template->Create(
    Queue   => 0,
    Name    => 'test',
    Type    => 'Simple',
    Content => <<'.',
===Create-Ticket: testing
Queue: General
Subject: duplicate: { $Tickets{TOP}->Subject }
.
);
ok $ok, $msg;

my $ticket = RT::Test->create_ticket(
    Queue   => 'General',
    Subject => 'a ticket',
);
ok $ticket->id, "created ticket";

for my $type (qw(Simple Perl)) {
    if ($template->Type ne $type) {
        my ($ok, $msg) = $template->SetType($type);
        ok $ok, $msg;
    }

    require RT::Action::CreateTickets;
    my $action = RT::Action::CreateTickets->new(
        CurrentUser     => RT->SystemUser,
        TemplateObj     => $template,
        TicketObj       => $ticket,
    );
    $action->{TransactionObj} = $ticket->Transactions->First;
    ok $action->Prepare, 'prepares';
    ok $action->Commit, 'commits';

    my $new_ticket = RT::Test->last_ticket;
    ok $new_ticket->id > $ticket->id, 'new ticket';

    if ($type eq 'Perl') {
        is $new_ticket->Subject, 'duplicate: a ticket', 'interpolated';
        isnt $new_ticket->Subject, 'duplicate: { $Tickets{TOP}->Subject }', 'interpolated';
    } else {
        isnt $new_ticket->Subject, 'duplicate: a ticket', 'not interpolated';
        is $new_ticket->Subject, 'duplicate: { $Tickets{TOP}->Subject }', 'not interpolated';
    }
}

done_testing;