M_Viper/deskhub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Upload via GUI (364 Dateien)

Browse Source
This commit is contained in:
M_Viper
2026-11-01 11:15:59 +00:00
parent c1a170563d
commit 4319ceec47
7 changed files with 331 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DeskHub-Webseite/tests/mobile_api_integration.php
+10
View File
@@ -224,6 +224,16 @@ try {
$stmt = $check->prepare('SELECT COUNT(*) FROM ticket_threads WHERE ticket_id = ? AND is_internal_note = 1');
$stmt->execute([$ticketId]);
assert_same(1, (int) $stmt->fetchColumn(), 'Interne Notiz fehlt in der Datenbank.');
// Browser-Erweiterung: Vorabfrage (OPTIONS) wird ohne Anmeldung beantwortet, CORS-Antwort nur für Erweiterungs-Adressen
$ctx = fn(string $method, string $origin) => stream_context_create(['http' => ['method' => $method, 'header' => "Origin: {$origin}\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization, content-type", 'ignore_errors' => true, 'timeout' => 10]]);
$extOrigin = 'chrome-extension://abcdefghijklmnopabcdefghijklmnop';
@file_get_contents("http://127.0.0.1:$port/api/staff/v1/login.php", false, $ctx('OPTIONS', $extOrigin));
$h = implode("\n", $http_response_header ?? []);
assert_true(str_contains($h, ' 204 '), 'OPTIONS von der Erweiterung muss mit 204 beantwortet werden.');
assert_true(str_contains($h, 'Access-Control-Allow-Origin: ' . $extOrigin) && stripos($h, 'Access-Control-Allow-Headers:') !== false && stripos($h, 'authorization') !== false, 'CORS-Antwort für die Erweiterung fehlt.');
@file_get_contents("http://127.0.0.1:$port/api/staff/v1/login.php", false, $ctx('OPTIONS', 'https://boese.example'));
$h = implode("\n", $http_response_header ?? []);
assert_true(stripos($h, 'Access-Control-Allow-Origin') === false, 'Fremde Webseiten dürfen keine CORS-Freigabe bekommen.');
echo "Mobile API integration test passed.\n";
} finally {
proc_terminate($process);