PageRenderTime 14ms CodeModel.GetById 1ms app.highlight 10ms RepoModel.GetById 1ms app.codeStats 0ms

/mod/php-intro/old/assn05.php

https://github.com/arwhyte/tsugi
PHP | 274 lines | 224 code | 43 blank | 7 comment | 43 complexity | 9d69f4c6ce9c9267cf334d472517a435 MD5 | raw file
  1<?php
  2
  3require_once "../../config.php";
  4require_once "webauto-old.php";
  5require_once "misc.php";
  6use Goutte\Client;
  7
  8line_out("Grading PHP-Intro Assignment 5");
  9
 10$url = getUrl('http://www.php-intro.com/assn/tracks');
 11$grade = 0;
 12
 13error_log("ASSN05 ".$url);
 14line_out("Retrieving ".htmlent_utf8($url)."...");
 15flush();
 16
 17$client = new Client();
 18
 19$crawler = $client->request('GET', $url);
 20
 21// Yes, one gigantic unindented try/catch block
 22$passed = 0;
 23$titlepassed = true;
 24try {
 25
 26$html = $crawler->html();
 27$OUTPUT->togglePre("Show retrieved page",$html);
 28
 29$retval = webauto_check_title($crawler);
 30if ( $retval !== true ) {
 31    error_out($retval);
 32    $titlepassed = false;
 33}
 34
 35line_out("Looking for Add New link.");
 36$link = $crawler->selectLink('Add New')->link();
 37$url = $link->getURI();
 38line_out("Retrieving ".htmlent_utf8($url)."...");
 39
 40$crawler = $client->request('GET', $url);
 41$html = $crawler->html();
 42$OUTPUT->togglePre("Show retrieved page",$html);
 43$passed++;
 44
 45// Add new fail
 46line_out("Looking for the form with a 'Add New' submit button");
 47$form = $crawler->selectButton('Add New')->form();
 48line_out("Setting non-integer values in the plays and rating form fields and leaving title blank");
 49$form->setValues(array("plays" => "many", "rating" => "awesome"));
 50$crawler = $client->submit($form);
 51$passed++;
 52
 53$html = $crawler->html();
 54$OUTPUT->togglePre("Show retrieved page",$html);
 55checkPostRedirect($client);
 56
 57line_out("Expecting 'Bad value for title, plays, or rating'");
 58if ( strpos(strtolower($html), 'bad value') !== false ) {
 59    $passed++;
 60} else {
 61    error_out("Could not find 'Bad value for title, plays, or rating'");
 62}
 63
 64line_out("Looking for Add New link.");
 65$link = $crawler->selectLink('Add New')->link();
 66$url = $link->getURI();
 67line_out("Retrieving ".htmlent_utf8($url)."...");
 68
 69$crawler = $client->request('GET', $url);
 70$html = $crawler->html();
 71$OUTPUT->togglePre("Show retrieved page",$html);
 72$passed++;
 73line_out("Looking for the form with a 'Add New' submit button");
 74$form = $crawler->selectButton('Add New')->form();
 75$title = 'ACDC'.sprintf("%03d",rand(1,100));
 76$plays = rand(1,100);
 77$rating = rand(1,100);
 78line_out("Entering title=$title, plays=$plays, rating=$rating");
 79$form->setValues(array("title" => $title, "plays" => $plays, "rating" => $rating));
 80$crawler = $client->submit($form);
 81$passed++;
 82
 83$html = $crawler->html();
 84$OUTPUT->togglePre("Show retrieved page",$html);
 85checkPostRedirect($client);
 86
 87line_out("Looking '$title' entry");
 88$pos = strpos($html, $title);
 89$pos2 = strpos($html, "edit.php", $pos);
 90$body = substr($html,$pos,$pos2-$pos);
 91# echo "body=",htmlentities($body);
 92line_out("Looking for plays=$plays and rating=$rating");
 93if ( strpos($body,''.$plays) < 1 || strpos($body,''.$rating) < 1 ) {
 94    error_out("Could not find plays=$plays and rating=$rating");
 95} else {
 96    $passed++;
 97}
 98
 99line_out("Looking for edit.php link associated with '$title' entry");
100$pos3 = strpos($html, '"', $pos2);
101$editlink = substr($html,$pos2,$pos3-$pos2);
102line_out("Retrieving ".htmlent_utf8($editlink)."...");
103
104$crawler = $client->request('GET', $editlink);
105$html = $crawler->html();
106$OUTPUT->togglePre("Show retrieved page",$html);
107$passed++;
108
109line_out("Looking for the form with a 'Update' submit button");
110$form = $crawler->selectButton('Update')->form();
111$plays = rand(1,100);
112$rating = rand(1,100);
113line_out("Editing title=$title, plays=$plays, rating=$rating");
114$form->setValues(array("title" => $title, "plays" => $plays, "rating" => $rating));
115$crawler = $client->submit($form);
116$html = $crawler->html();
117$OUTPUT->togglePre("Show retrieved page",$html);
118$passed++;
119checkPostRedirect($client);
120
121// Delete...
122line_out("Looking '$title' entry");
123$pos = strpos($html, $title);
124$pos2 = strpos($html, "delete.php", $pos);
125$body = substr($html,$pos,$pos2-$pos);
126# echo "body=",htmlentities($body);
127line_out("Looking for plays=$plays and rating=$rating");
128if ( strpos($body,''.$plays) < 1 || strpos($body,''.$rating) < 1 ) {
129    error_out("Could not find plays=$plays and rating=$rating");
130} else {
131    $passed++;
132}
133
134line_out("Looking for delete.php link associated with '$title' entry");
135$pos3 = strpos($html, '"', $pos2);
136$editlink = substr($html,$pos2,$pos3-$pos2);
137line_out("Retrieving ".htmlent_utf8($editlink)."...");
138
139$crawler = $client->request('GET', $editlink);
140$html = $crawler->html();
141$OUTPUT->togglePre("Show retrieved page",$html);
142$passed++;
143
144// Do the Delete
145line_out("Looking for the form with a 'Delete' submit button");
146$form = $crawler->selectButton('Delete')->form();
147$crawler = $client->submit($form);
148$html = $crawler->html();
149$OUTPUT->togglePre("Show retrieved page",$html);
150$passed++;
151checkPostRedirect($client);
152
153line_out("Making sure '$title' has been deleted");
154if ( strpos($html,$title) > 0 ) {
155    error_out("Entry '$title' not deleted");
156} else {
157    $passed++;
158}
159
160line_out("Cleaning up old ACDC records...");
161while (True ) {
162    $pos = strpos($html, 'ACDC');
163    if ( $pos < 1 ) break;
164    $pos2 = strpos($html, "delete.php", $pos);
165    if ( $pos2 < 1 ) break;
166    $pos3 = strpos($html, '"', $pos2);
167    if ( $pos3 < 1 ) break;
168    $editlink = substr($html,$pos2,$pos3-$pos2);
169    line_out("Retrieving ".htmlent_utf8($editlink)."...");
170
171    $crawler = $client->request('GET', $editlink);
172    $html = $crawler->html();
173    $OUTPUT->togglePre("Show retrieved page",$html);
174    $passed++;
175
176    // Do the Delete
177    line_out("Looking for the form with a 'Delete' submit button");
178    $form = $crawler->selectButton('Delete')->form();
179    $crawler = $client->submit($form);
180    $html = $crawler->html();
181    $OUTPUT->togglePre("Show retrieved page",$html);
182    $passed++;
183    checkPostRedirect($client);
184}
185
186line_out("Testing for HTML injection (proper use of htmlentities)...");
187line_out("Looking for Add New link.");
188$link = $crawler->selectLink('Add New')->link();
189$url = $link->getURI();
190line_out("Retrieving ".htmlent_utf8($url)."...");
191
192$crawler = $client->request('GET', $url);
193$html = $crawler->html();
194$OUTPUT->togglePre("Show retrieved page",$html);
195$passed++;
196
197line_out("Looking for the form with a 'Add New' submit button");
198$form = $crawler->selectButton('Add New')->form();
199$title = 'AC<DC'.sprintf("%03d",rand(1,100));
200$plays = rand(1,100);
201$rating = rand(1,100);
202line_out("Entering title=$title, plays=$plays, rating=$rating");
203$form->setValues(array("title" => $title, "plays" => $plays, "rating" => $rating));
204$crawler = $client->submit($form);
205$passed++;
206
207$html = $crawler->html();
208$OUTPUT->togglePre("Show retrieved page",$html);
209checkPostRedirect($client);
210
211$pos = strpos($html, "AC&lt;DC");
212if ( $pos > 0 ) {
213    $passed+=2;
214} else {
215    error_out("Found HTML Injection");
216    throw new Exception("Found HTML Injection");
217}
218$pos2 = strpos($html, "delete.php", $pos);
219line_out("Looking for delete.php link associated with '$title' entry");
220$pos3 = strpos($html, '"', $pos2);
221$editlink = substr($html,$pos2,$pos3-$pos2);
222line_out("Retrieving ".htmlent_utf8($editlink)."...");
223
224$crawler = $client->request('GET', $editlink);
225$html = $crawler->html();
226$OUTPUT->togglePre("Show retrieved page",$html);
227$passed++;
228
229$pos = strpos($html, "AC&lt;DC");
230if ( $pos > 0 ) {
231    $passed+=2;
232} else {
233    error_out("Found HTML Injection");
234    throw new Exception("Found HTML Injection");
235}
236
237line_out("Looking for the form with a 'Delete' submit button");
238$form = $crawler->selectButton('Delete')->form();
239$crawler = $client->submit($form);
240$html = $crawler->html();
241$OUTPUT->togglePre("Show retrieved page",$html);
242$passed++;
243checkPostRedirect($client);
244
245
246} catch (Exception $ex) {
247    error_out("The autograder did not find something it was looking for in your HTML - test ended.");
248    error_log($ex->getMessage());
249    error_log($ex->getTraceAsString());
250    $detail = "This indicates the source code line where the test stopped.\n" .
251        "It may not make any sense without looking at the source code for the test.\n".
252        'Caught exception: '.$ex->getMessage()."\n".$ex->getTraceAsString()."\n";
253    $OUTPUT->togglePre("Internal error detail.",$detail);
254}
255
256$perfect = 26;
257$score = $passed * (1.0 / $perfect);
258if ( $score < 0 ) $score = 0;
259if ( $score > 1 ) $score = 1;
260$scorestr = "Score = $score ($passed/$perfect)";
261if ( $penalty === false ) {
262    line_out("Score = $score ($passed/$perfect)");
263} else {
264    $score = $score * (1.0 - $penalty);
265    line_out("Score = $score ($passed/$perfect) penalty=$penalty");
266}
267
268if ( ! $titlepassed ) {
269    error_out("These pages do not have proper titles so this grade is not official");
270    return;
271}
272
273if ( $score > 0.0 ) webauto_test_passed($score, $url);
274