mirror of
https://github.com/Vateron-Media/XC_VM.git
synced 2026-10-31 11:03:22 +01:00
obscuremindandClaude Opus 4.8
a3b5010bb0
Two defects the Parches module patches, still present in 2.6.7: - A reseller could put any domain on the codes it generates: ActiveCodeService::generateCodes took dns_base straight from form input, feeding the code's portal host and the downloadable list unchecked. A reseller's dns_base is now validated against its own reseller_dns list and a forged value is dropped to the server domain; an admin may still set any (1.14.21). - A reseller's Quick Stream Links / Xtream API download and EPG URLs were built from the server's site_url, not the reseller's domain. reseller/lines.php now builds the base from the reseller's reseller_dns (first of the list), keeping the server base's scheme and port (1.14.19). Regression locks in ParchesResellerDomainTest. Full suite 5430/0, gates 5/5. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AneTzAHPPkYWPQjwyZ2td9
27 lines
1.4 KiB
PHP
27 lines
1.4 KiB
PHP
<?php
|
|
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
/**
|
|
* Regression locks for the reseller-domain fixes ported from the Parches module
|
|
* (verified still-present in 2.6.7). A reseller must not be able to put an
|
|
* arbitrary domain on the codes it generates, and its own download/EPG links
|
|
* should carry its reseller_dns, not the server's domain.
|
|
*/
|
|
final class ParchesResellerDomainTest extends TestCase {
|
|
|
|
/** 1.14.21 — a reseller's forged dns_base (not one of its reseller_dns values) is ignored. */
|
|
public function testResellerDnsBaseConstrainedToOwnDomains(): void {
|
|
$rSvc = (string) file_get_contents(MAIN_HOME . 'Domain/Line/ActiveCodeService.php');
|
|
$this->assertStringContainsString('if (!$isAdmin && $dnsBase !== null) {', $rSvc, 'a reseller dns_base is validated, an admin may set any');
|
|
$this->assertStringContainsString('in_array($dnsBase, $rResellerDomains, true)', $rSvc, 'the dns_base must be one of the reseller own reseller_dns values');
|
|
}
|
|
|
|
/** 1.14.19 — a reseller's download/EPG links are built from its reseller_dns, not the server domain. */
|
|
public function testResellerDownloadLinksUseResellerDns(): void {
|
|
$rView = (string) file_get_contents(MAIN_HOME . 'Public/Views/reseller/lines.php');
|
|
$this->assertStringContainsString("\$rUserInfo['reseller_dns']", $rView, 'the download base considers the reseller dns');
|
|
$this->assertStringContainsString('$rResellerHost', $rView, 'and swaps the host into the base URL');
|
|
}
|
|
}
|