PageRenderTime 18ms CodeModel.GetById 1ms app.highlight 13ms RepoModel.GetById 1ms app.codeStats 0ms

/mod/php-intro/a06.php

https://github.com/arwhyte/tsugi
PHP | 264 lines | 213 code | 43 blank | 8 comment | 43 complexity | a8ab1f5529208445ba4ecc28119bddde MD5 | raw file
  1<?php
  2
  3require_once "../../config.php";
  4require_once "webauto.php";
  5use Goutte\Client;
  6
  7line_out("Grading PHP-Intro Assignment 6");
  8
  9$url = getUrl('http://www.php-intro.com/assn/tracks');
 10if ( $url === false ) return;
 11$grade = 0;
 12
 13error_log("ASSN05 ".$url);
 14line_out("Retrieving ".htmlent_utf8($url)."...");
 15flush();
 16
 17$client = new Client();
 18
 19$crawler = $client->request('GET', $url);
 20
 21// Yes, one gigantic unindented try/catch block
 22$passed = 0;
 23$titlefound = true;
 24try {
 25
 26$html = $crawler->html();
 27$OUTPUT->togglePre("Show retrieved page",$html);
 28
 29$retval = webauto_check_title($crawler);
 30if ( $retval !== true ) {
 31    error_out($retval);
 32    $titlefound = false;
 33}
 34
 35line_out("Looking for Add New link in index.php.");
 36$link = $crawler->selectLink('Add New')->link();
 37$url = $link->getURI();
 38line_out("Retrieving ".htmlent_utf8($url)."...");
 39
 40$crawler = $client->request('GET', $url);
 41$html = $crawler->html();
 42$OUTPUT->togglePre("Show retrieved page",$html);
 43$passed++;
 44
 45// Add new fail
 46line_out("Looking for the form with a 'Add New' submit button");
 47$form = $crawler->selectButton('Add New')->form();
 48line_out("Setting non-integer values in the plays and rating form fields and leaving title blank");
 49$form->setValues(array("plays" => "many", "rating" => "awesome"));
 50$crawler = $client->submit($form);
 51$passed++;
 52
 53$html = $crawler->html();
 54$OUTPUT->togglePre("Show retrieved page",$html);
 55checkPostRedirect($client);
 56
 57line_out("Expecting 'Bad value for title, plays, or rating' error in index.php");
 58if ( strpos(strtolower($html), 'bad value') !== false ) {
 59    $passed++;
 60} else {
 61    error_out("Could not find flash message with 'Bad value for title, plays, or rating'");
 62}
 63
 64line_out("Looking for Add New link in index.php.");
 65$link = $crawler->selectLink('Add New')->link();
 66$url = $link->getURI();
 67line_out("Retrieving ".htmlent_utf8($url)."...");
 68
 69$crawler = $client->request('GET', $url);
 70$html = $crawler->html();
 71$OUTPUT->togglePre("Show retrieved page",$html);
 72$passed++;
 73line_out("Looking for the form with a 'Add New' submit button");
 74$form = $crawler->selectButton('Add New')->form();
 75$title = 'ACDC'.sprintf("%03d",rand(1,100));
 76$plays = rand(1,100);
 77$rating = rand(1,100);
 78line_out("Entering title=$title, plays=$plays, rating=$rating");
 79$form->setValues(array("title" => $title, "plays" => $plays, "rating" => $rating));
 80$crawler = $client->submit($form);
 81$passed++;
 82
 83$html = $crawler->html();
 84$OUTPUT->togglePre("Show retrieved page",$html);
 85checkPostRedirect($client);
 86
 87line_out("Looking '$title' entry");
 88$pos = strpos($html, $title);
 89$pos2 = strpos($html, "edit.php", $pos);
 90$body = substr($html,$pos,$pos2-$pos);
 91# echo "body=",htmlentities($body);
 92line_out("Looking for plays=$plays and rating=$rating");
 93if ( strpos($body,''.$plays) < 1 || strpos($body,''.$rating) < 1 ) {
 94    error_out("Could not find plays=$plays and rating=$rating");
 95} else {
 96    $passed++;
 97}
 98
 99line_out("Looking for edit.php link associated with '$title' entry");
100$pos3 = strpos($html, '"', $pos2);
101$editlink = substr($html,$pos2,$pos3-$pos2);
102line_out("Retrieving ".htmlent_utf8($editlink)."...");
103
104$crawler = $client->request('GET', $editlink);
105$html = $crawler->html();
106$OUTPUT->togglePre("Show retrieved page",$html);
107$passed++;
108
109line_out("Looking for the form with a 'Update' submit button");
110$form = $crawler->selectButton('Update')->form();
111$plays = rand(1,100);
112$rating = rand(1,100);
113line_out("Editing title=$title, plays=$plays, rating=$rating");
114$form->setValues(array("title" => $title, "plays" => $plays, "rating" => $rating));
115$crawler = $client->submit($form);
116$html = $crawler->html();
117$OUTPUT->togglePre("Show retrieved page",$html);
118$passed++;
119checkPostRedirect($client);
120
121// Delete...
122line_out("Looking '$title' entry");
123$pos = strpos($html, $title);
124$pos2 = strpos($html, "delete.php", $pos);
125$body = substr($html,$pos,$pos2-$pos);
126# echo "body=",htmlentities($body);
127line_out("Looking for plays=$plays and rating=$rating");
128if ( strpos($body,''.$plays) < 1 || strpos($body,''.$rating) < 1 ) {
129    error_out("Could not find plays=$plays and rating=$rating");
130} else {
131    $passed++;
132}
133
134line_out("Looking for delete.php link associated with '$title' entry");
135$pos3 = strpos($html, '"', $pos2);
136$editlink = substr($html,$pos2,$pos3-$pos2);
137line_out("Retrieving ".htmlent_utf8($editlink)."...");
138
139$crawler = $client->request('GET', $editlink);
140$html = $crawler->html();
141$OUTPUT->togglePre("Show retrieved page",$html);
142$passed++;
143
144// Do the Delete
145line_out("Looking for the form with a 'Delete' submit button");
146$form = $crawler->selectButton('Delete')->form();
147$crawler = $client->submit($form);
148$html = $crawler->html();
149$OUTPUT->togglePre("Show retrieved page",$html);
150$passed++;
151checkPostRedirect($client);
152
153line_out("Making sure '$title' has been deleted");
154if ( strpos($html,$title) > 0 ) {
155    error_out("Entry '$title' not deleted");
156} else {
157    $passed++;
158}
159
160line_out("Cleaning up old records...");
161while (True ) {
162    $pos2 = strpos($html, "delete.php");
163    if ( $pos2 < 1 ) break;
164    $pos3 = strpos($html, '"', $pos2);
165    if ( $pos3 < 1 ) break;
166    $editlink = substr($html,$pos2,$pos3-$pos2);
167    line_out("Retrieving ".htmlent_utf8($editlink)."...");
168
169    $crawler = $client->request('GET', $editlink);
170    $html = $crawler->html();
171    $OUTPUT->togglePre("Show retrieved page",$html);
172
173    // Do the Delete
174    line_out("Looking for the form with a 'Delete' submit button");
175    $form = $crawler->selectButton('Delete')->form();
176    $crawler = $client->submit($form);
177    $html = $crawler->html();
178    $OUTPUT->togglePre("Show retrieved page",$html);
179    checkPostRedirect($client);
180    $passed--; // Since checkPostRedirect() gives a pass
181}
182
183line_out("Testing for HTML injection (proper use of htmlentities)...");
184line_out("Looking for Add New link in index.php.");
185$link = $crawler->selectLink('Add New')->link();
186$url = $link->getURI();
187line_out("Retrieving ".htmlent_utf8($url)."...");
188
189$crawler = $client->request('GET', $url);
190$html = $crawler->html();
191$OUTPUT->togglePre("Show retrieved page",$html);
192$passed++;
193
194line_out("Looking for the form with a 'Add New' submit button");
195$form = $crawler->selectButton('Add New')->form();
196$title = 'AC<DC'.sprintf("%03d",rand(1,100));
197$plays = rand(1,100);
198$rating = rand(1,100);
199line_out("Entering title=$title, plays=$plays, rating=$rating");
200$form->setValues(array("title" => $title, "plays" => $plays, "rating" => $rating));
201$crawler = $client->submit($form);
202$passed++;
203
204$html = $crawler->html();
205$OUTPUT->togglePre("Show retrieved page",$html);
206checkPostRedirect($client);
207
208if ( strpos($html, "AC&lt;DC") > 2 ) {
209    $passed+=2;
210} else if ( strpos($html, "&amp;lt;") > 2  ) {
211    error_out("It looks like you have double-called htmlentities()");
212} else {
213    error_out("Found HTML Injection");
214}
215
216$pos = strpos($html, $title);
217$pos2 = strpos($html, "delete.php", $pos);
218line_out("Looking for delete.php link associated with '$title' entry");
219$pos3 = strpos($html, '"', $pos2);
220$editlink = substr($html,$pos2,$pos3-$pos2);
221line_out("Retrieving ".htmlent_utf8($editlink)."...");
222
223$crawler = $client->request('GET', $editlink);
224$html = $crawler->html();
225$OUTPUT->togglePre("Show retrieved page",$html);
226$passed++;
227
228if ( strpos($html, "AC&lt;DC") > 2 ) {
229    $passed+=2;
230} else if ( strpos($html, "&amp;lt;") > 2  ) {
231    error_out("It looks like you have double-called htmlentities()");
232} else {
233    error_out("Found HTML Injection");
234}
235
236line_out("Looking for the form with a 'Delete' submit button");
237$form = $crawler->selectButton('Delete')->form();
238$crawler = $client->submit($form);
239$html = $crawler->html();
240$OUTPUT->togglePre("Show retrieved page",$html);
241$passed++;
242checkPostRedirect($client);
243
244
245} catch (Exception $ex) {
246    error_out("The autograder did not find something it was looking for in your HTML - test ended.");
247    error_log($ex->getMessage());
248    error_log($ex->getTraceAsString());
249    $detail = "This indicates the source code line where the test stopped.\n" .
250        "It may not make any sense without looking at the source code for the test.\n".
251        'Caught exception: '.$ex->getMessage()."\n".$ex->getTraceAsString()."\n";
252    $OUTPUT->togglePre("Internal error detail.",$detail);
253}
254
255// There is a maximum of 26 passes for this test
256$perfect = 26;
257$score = webauto_compute_effective_score($perfect, $passed, $penalty);
258
259if ( ! $titlefound ) {
260    error_out("These pages do not have proper titles so this grade is not official");
261    return;
262}
263
264if ( $score > 0.0 ) webauto_test_passed($score, $url);