Merge pull request #3107 from marc1706/ticket/13280

[ticket/13280] Properly format the current page and add sanitizer to tests

* marc1706/ticket/13280:
  [ticket/13280] Remove unneeded str_replace in build_url()
  [ticket/13280] Only run sanitizer for server superglobal and modify tests
  [ticket/13280] Seperate server sanitizer call and add comment
  [ticket/13280] Add additional sanitizer for ampersands in server superglobal
  [ticket/13280] Correctly format user page for build_url()
  [ticket/13280] Properly format the current page and add sanitizer to tests

1 files changed, 20 insertions, 8 deletions

diff --git a/tests/security/extract_current_page_test.php b/tests/security/extract_current_page_test.php
index 58dea68dc8..c127b69b2b 100644
--- a/tests/security/extract_current_page_test.php
+++ b/tests/security/extract_current_page_test.php
@@ -37,16 +37,16 @@ class phpbb_security_extract_current_page_test extends phpbb_security_test_base
 		));
 		$symfony_request->expects($this->any())
 			->method('getScriptName')
-			->will($this->returnValue($url));
+			->will($this->returnValue($this->sanitizer($url)));
 		$symfony_request->expects($this->any())
 			->method('getQueryString')
-			->will($this->returnValue($query_string));
+			->will($this->returnValue($this->sanitizer($query_string)));
 		$symfony_request->expects($this->any())
 			->method('getBasePath')
 			->will($this->returnValue($server['REQUEST_URI']));
-		$symfony_request->expects($this->any())
+		$symfony_request->expects($this->sanitizer($this->any()))
 			->method('getPathInfo')
-			->will($this->returnValue('/'));
+			->will($this->returnValue($this->sanitizer('/')));
 		$result = \phpbb\session::extract_current_page('./');
 
 		$label = 'Running extract_current_page on ' . $query_string . ' with PHP_SELF filled.';
@@ -65,20 +65,32 @@ class phpbb_security_extract_current_page_test extends phpbb_security_test_base
 		));
 		$symfony_request->expects($this->any())
 			->method('getScriptName')
-			->will($this->returnValue($url));
+			->will($this->returnValue($this->sanitizer($url)));
 		$symfony_request->expects($this->any())
 			->method('getQueryString')
-			->will($this->returnValue($query_string));
+			->will($this->returnValue($this->sanitizer($query_string)));
 		$symfony_request->expects($this->any())
 			->method('getBasePath')
-			->will($this->returnValue($server['REQUEST_URI']));
+			->will($this->returnValue($this->sanitizer($server['REQUEST_URI'])));
 		$symfony_request->expects($this->any())
 			->method('getPathInfo')
-			->will($this->returnValue('/'));
+			->will($this->returnValue($this->sanitizer('/')));
 
 		$result = \phpbb\session::extract_current_page('./');
 
 		$label = 'Running extract_current_page on ' . $query_string . ' with REQUEST_URI filled.';
 		$this->assertEquals($expected, $result['query_string'], $label);
 	}
+
+	protected function sanitizer($value)
+	{
+		// Fix for objects passed in phpunit
+		if (is_object($value))
+		{
+			return $value;
+		}
+		$type_cast_helper = new \phpbb\request\type_cast_helper();
+		$type_cast_helper->set_var($value, $value, gettype($value), true);
+		return str_replace('&', '&', $value);
+	}
 }