Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat.
diff --git a/public/assets/form/form.js b/public/assets/form/form.js index ed4d2d7ed..fa21bed91 100644 --- a/public/assets/form/form.js +++ b/public/assets/form/form.js @@ -204,8 +204,14 @@ $(function() { if (this.options.test) { params.test = true } + + params.fingerprint = this.fingerprint() + $.ajax({ + method: 'post', url: _this.endpoint_config, + cache: false, + processData: true, data: params }).done(function(data) { _this.log('debug', 'config:', data) @@ -256,7 +262,7 @@ $(function() { _this.log('debug', 'currentTime', currentTime) _this.log('debug', 'modalOpenTime', _this.modalOpenTime.getTime()) _this.log('debug', 'diffTime', diff) - if (diff < 1000*8) { + if (diff < 1000*10) { alert('Sorry, you look like an robot!') return } @@ -317,7 +323,10 @@ $(function() { formData.append('test', true) } formData.append('token', this._config.token) + + formData.append('fingerprint', this.fingerprint()) _this.log('debug', 'formData', formData) + return formData } @@ -463,6 +472,22 @@ $(function() { return string } + Plugin.prototype.fingerprint = function () { + var canvas = document.createElement('canvas') + var ctx = canvas.getContext('2d') + var txt = 'https://zammad.com' + ctx.textBaseline = 'top' + ctx.font = '12px \'Arial\'' + ctx.textBaseline = 'alphabetic' + ctx.fillStyle = '#f60' + ctx.fillRect(125,1,62,20) + ctx.fillStyle = '#069' + ctx.fillText(txt, 2, 15) + ctx.fillStyle = 'rgba(100, 200, 0, 0.7)' + ctx.fillText(txt, 4, 17) + return canvas.toDataURL() + } + $.fn[pluginName] = function (options) { return this.each(function () { var instance = $.data(this, 'plugin_' + pluginName) diff --git a/test/browser/form_test.rb b/test/browser/form_test.rb index 5bb89f5d0..8b6f35a91 100644 --- a/test/browser/form_test.rb +++ b/test/browser/form_test.rb @@ -82,23 +82,6 @@ class FormTest < TestCase browser: agent, css: 'body div.zammad-form-modal button[type="submit"][disabled]', ) - set( - browser: agent, - css: 'body div.zammad-form-modal [name="email"]', - value: 'notexistinginanydomainspacealsonothere@znuny.com', - ) - click( - browser: agent, - css: 'body div.zammad-form-modal button[type="submit"]', - ) - watch_for( - browser: agent, - css: 'body div.zammad-form-modal .has-error [name="email"]', - ) - watch_for_disappear( - browser: agent, - css: 'body div.zammad-form-modal button[type="submit"][disabled]', - ) set( browser: agent, css: 'body div.zammad-form-modal [name="email"]', @@ -315,23 +298,6 @@ class FormTest < TestCase browser: customer, css: 'body div.zammad-form-modal button[type="submit"][disabled]', ) - set( - browser: customer, - css: 'body div.zammad-form-modal [name="email"]', - value: 'notexistinginanydomainspacealsonothere@znuny.com', - ) - click( - browser: customer, - css: 'body div.zammad-form-modal button[type="submit"]', - ) - watch_for( - browser: customer, - css: 'body div.zammad-form-modal .has-error [name="email"]', - ) - watch_for_disappear( - browser: customer, - css: 'body div.zammad-form-modal button[type="submit"][disabled]', - ) set( browser: customer, css: 'body div.zammad-form-modal [name="email"]', diff --git a/test/controllers/form_controller_test.rb b/test/controllers/form_controller_test.rb new file mode 100644 index 000000000..f3c8e3612 --- /dev/null +++ b/test/controllers/form_controller_test.rb @@ -0,0 +1,241 @@ +# encoding: utf-8 +require 'test_helper' +require 'rake' + +class FormControllerTest < ActionDispatch::IntegrationTest + setup do + @headers = { 'ACCEPT' => 'application/json', 'CONTENT_TYPE' => 'application/json', 'REMOTE_ADDR' => '1.2.3.4' } + + if ENV['ES_URL'].present? + + #fail "ERROR: Need ES_URL - hint ES_URL='http://127.0.0.1:9200'" + Setting.set('es_url', ENV['ES_URL']) + + # Setting.set('es_url', 'http://127.0.0.1:9200') + # Setting.set('es_index', 'estest.local_zammad') + # Setting.set('es_user', 'elasticsearch') + # Setting.set('es_password', 'zammad') + + if ENV['ES_INDEX_RAND'].present? + ENV['ES_INDEX'] = "es_index_#{rand(999_999_999)}" + end + if ENV['ES_INDEX'].blank? + raise "ERROR: Need ES_INDEX - hint ES_INDEX='estest.local_zammad'" + end + Setting.set('es_index', ENV['ES_INDEX']) + end + + Ticket.destroy_all + + # drop/create indexes + Setting.reload + Rake::Task.clear + Zammad::Application.load_tasks + Rake::Task['searchindex:rebuild'].execute + end + + test '01 - get config call' do + post '/api/v1/form_config', {}.to_json, @headers + assert_response(401) + result = JSON.parse(@response.body) + assert_equal(result.class, Hash) + assert_equal(result['error'], 'Not authorized') + end + + test '02 - get config call' do + Setting.set('form_ticket_create', true) + post '/api/v1/form_config', {}.to_json, @headers + assert_response(401) + result = JSON.parse(@response.body) + assert_equal(result.class, Hash) + assert_equal(result['error'], 'Not authorized') + + end + + test '03 - get config call & do submit' do + Setting.set('form_ticket_create', true) + fingerprint = SecureRandom.hex(40) + post '/api/v1/form_config', { fingerprint: fingerprint }.to_json, @headers + + assert_response(200) + result = JSON.parse(@response.body) + assert_equal(result.class, Hash) + assert_equal(result['enabled'], true) + assert_equal(result['endpoint'], 'http://zammad.example.com/api/v1/form_submit') + assert(result['token']) + token = result['token'] + + post '/api/v1/form_submit', { fingerprint: fingerprint, token: 'invalid' }.to_json, @headers + assert_response(401) + result = JSON.parse(@response.body) + assert_equal(result.class, Hash) + assert_equal(result['error'], 'Not authorized') + + post '/api/v1/form_submit', { fingerprint: fingerprint, token: token }.to_json, @headers + assert_response(200) + result = JSON.parse(@response.body) + assert_equal(result.class, Hash) + + assert(result['errors']) + assert_equal(result['errors']['name'], 'required') + assert_equal(result['errors']['email'], 'required') + assert_equal(result['errors']['title'], 'required') + assert_equal(result['errors']['body'], 'required') + + post '/api/v1/form_submit', { fingerprint: fingerprint, token: token, email: 'some' }.to_json, @headers + assert_response(200) + result = JSON.parse(@response.body) + assert_equal(result.class, Hash) + + assert(result['errors']) + assert_equal(result['errors']['name'], 'required') + assert_equal(result['errors']['email'], 'invalid') + assert_equal(result['errors']['title'], 'required') + assert_equal(result['errors']['body'], 'required') + + post '/api/v1/form_submit', { fingerprint: fingerprint, token: token, name: 'Bob Smith', email: 'discard@znuny.com', title: 'test', body: 'hello' }.to_json, @headers + assert_response(200) + result = JSON.parse(@response.body) + assert_equal(result.class, Hash) + + assert_not(result['errors']) + assert(result['ticket']) + assert(result['ticket']['id']) + assert(result['ticket']['number']) + + travel 5.hours + + post '/api/v1/form_submit', { fingerprint: fingerprint, token: token, name: 'Bob Smith', email: 'discard@znuny.com', title: 'test', body: 'hello' }.to_json, @headers + + assert_response(200) + result = JSON.parse(@response.body) + assert_equal(result.class, Hash) + + assert_not(result['errors']) + assert(result['ticket']) + assert(result['ticket']['id']) + assert(result['ticket']['number']) + + travel 20.hours + + post '/api/v1/form_submit', { fingerprint: fingerprint, token: token, name: 'Bob Smith', email: 'discard@znuny.com', title: 'test', body: 'hello' }.to_json, @headers + assert_response(401) + + end + + test '04 - get config call & do submit' do + Setting.set('form_ticket_create', true) + fingerprint = SecureRandom.hex(40) + post '/api/v1/form_config', { fingerprint: fingerprint }.to_json, @headers + + assert_response(200) + result = JSON.parse(@response.body) + assert_equal(result.class, Hash) + assert_equal(result['enabled'], true) + assert_equal(result['endpoint'], 'http://zammad.example.com/api/v1/form_submit') + assert(result['token']) + token = result['token'] + + post '/api/v1/form_submit', { fingerprint: fingerprint, token: 'invalid' }.to_json, @headers + assert_response(401) + result = JSON.parse(@response.body) + assert_equal(result.class, Hash) + assert_equal(result['error'], 'Not authorized') + + post '/api/v1/form_submit', { fingerprint: fingerprint, token: token }.to_json, @headers + assert_response(200) + result = JSON.parse(@response.body) + assert_equal(result.class, Hash) + + assert(result['errors']) + assert_equal(result['errors']['name'], 'required') + assert_equal(result['errors']['email'], 'required') + assert_equal(result['errors']['title'], 'required') + assert_equal(result['errors']['body'], 'required') + + post '/api/v1/form_submit', { fingerprint: fingerprint, token: token, email: 'some' }.to_json, @headers + assert_response(200) + result = JSON.parse(@response.body) + assert_equal(result.class, Hash) + + assert(result['errors']) + assert_equal(result['errors']['name'], 'required') + assert_equal(result['errors']['email'], 'invalid') + assert_equal(result['errors']['title'], 'required') + assert_equal(result['errors']['body'], 'required') + + post '/api/v1/form_submit', { fingerprint: fingerprint, token: token, name: 'Bob Smith', email: 'somebody@example.com', title: 'test', body: 'hello' }.to_json, @headers + assert_response(200) + result = JSON.parse(@response.body) + assert_equal(result.class, Hash) + + assert(result['errors']) + assert_equal(result['errors']['email'], 'invalid') + + end + + test '05 - limits' do + return if !SearchIndexBackend.enabled? + + Setting.set('form_ticket_create', true) + fingerprint = SecureRandom.hex(40) + post '/api/v1/form_config', { fingerprint: fingerprint }.to_json, @headers + + assert_response(200) + result = JSON.parse(@response.body) + assert_equal(result.class, Hash) + assert_equal(result['enabled'], true) + assert_equal(result['endpoint'], 'http://zammad.example.com/api/v1/form_submit') + assert(result['token']) + token = result['token'] + + (1..20).each { |count| + travel 10.seconds + post '/api/v1/form_submit', { fingerprint: fingerprint, token: token, name: 'Bob Smith', email: 'discard@znuny.com', title: "test#{count}", body: 'hello' }.to_json, @headers + assert_response(200) + result = JSON.parse(@response.body) + assert_equal(result.class, Hash) + + assert_not(result['errors']) + assert(result['ticket']) + assert(result['ticket']['id']) + assert(result['ticket']['number']) + Scheduler.worker(true) + sleep 1 # wait until elasticsearch is index + } + + sleep 10 # wait until elasticsearch is index + + post '/api/v1/form_submit', { fingerprint: fingerprint, token: token, name: 'Bob Smith', email: 'discard@znuny.com', title: 'test-last', body: 'hello' }.to_json, @headers + assert_response(401) + result = JSON.parse(@response.body) + assert_equal(result.class, Hash) + assert(result['error']) + + @headers = { 'ACCEPT' => 'application/json', 'CONTENT_TYPE' => 'application/json', 'REMOTE_ADDR' => '1.2.3.5' } + + (1..20).each { |count| + travel 10.seconds + post '/api/v1/form_submit', { fingerprint: fingerprint, token: token, name: 'Bob Smith', email: 'discard@znuny.com', title: "test-2-#{count}", body: 'hello' }.to_json, @headers + assert_response(200) + result = JSON.parse(@response.body) + assert_equal(result.class, Hash) + + assert_not(result['errors']) + assert(result['ticket']) + assert(result['ticket']['id']) + assert(result['ticket']['number']) + Scheduler.worker(true) + sleep 1 # wait until elasticsearch is index + } + + sleep 10 # wait until elasticsearch is index + + post '/api/v1/form_submit', { fingerprint: fingerprint, token: token, name: 'Bob Smith', email: 'discard@znuny.com', title: 'test-2-last', body: 'hello' }.to_json, @headers + assert_response(401) + result = JSON.parse(@response.body) + assert_equal(result.class, Hash) + assert(result['error']) + end + +end