File manager

File manager - Edit - /home/webapp69.cm.in.th/u69319090028/Shop/scratch/test_language_switcher.php

Back
<?php /** * Language Switcher & Security Hardening Verification Suite */ require_once __DIR__ . '/../config/app.php'; require_once __DIR__ . '/../app/Helpers/Url.php'; require_once __DIR__ . '/../app/Helpers/Language.php'; require_once __DIR__ . '/../app/Core/Router.php'; require_once __DIR__ . '/../app/Controllers/HomeController.php'; $totalPassed = 0; $totalFailed = 0; function assertTest(bool $condition, string $name) { global $totalPassed, $totalFailed; if ($condition) { echo " [PASS] {$name}" . PHP_EOL; $totalPassed++; } else { echo " [FAIL] {$name}" . PHP_EOL; $totalFailed++; } } echo PHP_EOL . "==========================================================" . PHP_EOL; echo "TEST SUITE: Language Switcher & Translation Loading" . PHP_EOL; echo "==========================================================" . PHP_EOL; // 1. Initial State / Default Locale Language::setLocale('th'); assertTest(Language::getLocale() === 'th', 'Default/Initial locale is Thai (th)'); assertTest(__('search_placeholder') === 'ค้นหาสินค้า ร้านค้า หรือแบรนด์ที่คุณต้องการ...', 'Thai translation loads correctly'); assertTest(__('cart') === 'รถเข็น', 'Thai translation for "cart" is correct'); // 2. Switch to English Language::setLocale('en'); assertTest(Language::getLocale() === 'en', 'Switch to English (en) updates locale'); assertTest(__('search_placeholder') === 'Search products, stores, or brands...', 'English translation loads correctly'); assertTest(__('cart') === 'Cart', 'English translation for "cart" is correct'); assertTest(__('login') === 'Sign In', 'English translation for "login" is correct'); // 3. Switch back to Thai Language::setLocale('th'); assertTest(Language::getLocale() === 'th', 'Switch back to Thai (th) updates locale'); assertTest(__('login') === 'เข้าสู่ระบบ', 'Thai translation for "login" is correct'); // 4. Security: Whitelist & LFI / Path Traversal Prevention Language::setLocale('fr'); assertTest(Language::getLocale() === 'th', 'Unsupported locale "fr" falls back to default "th"'); Language::setLocale('../../etc/passwd'); assertTest(Language::getLocale() === 'th', 'LFI payload "../../etc/passwd" falls back to default "th"'); Language::setLocale('en\0.php'); assertTest(Language::getLocale() === 'th', 'Null byte injection falls back to default "th"'); echo PHP_EOL . "==========================================================" . PHP_EOL; echo "TEST SUITE: switchUrl Helper & Query Preservation" . PHP_EOL; echo "==========================================================" . PHP_EOL; $_SERVER['REQUEST_URI'] = '/CARGOO/search?q=wireless+earbuds&sort=price_asc'; $switchEnUrl = Language::switchUrl('en'); assertTest(str_contains($switchEnUrl, '/CARGOO/language/en'), 'switchUrl generates /language/en route'); assertTest(str_contains($switchEnUrl, 'return=' . urlencode('/CARGOO/search?q=wireless+earbuds&sort=price_asc')), 'switchUrl preserves request URI with query parameters'); $switchThUrl = Language::switchUrl('th'); assertTest(str_contains($switchThUrl, '/CARGOO/language/th'), 'switchUrl generates /language/th route'); // Avoid loop in switchUrl $_SERVER['REQUEST_URI'] = '/CARGOO/language/en?return=%2FCARGOO%2Fsearch'; $switchNoLoopUrl = Language::switchUrl('th'); assertTest(!str_contains($switchNoLoopUrl, 'return='), 'switchUrl strips return parameter if current URI is language switch action'); echo PHP_EOL . "==========================================================" . PHP_EOL; echo "TEST SUITE: HomeController Redirect URL Sanitizer (Open Redirect Defense)" . PHP_EOL; echo "==========================================================" . PHP_EOL; $homeController = new HomeController(); // Valid Relative URL $safe1 = $homeController->sanitizeRedirectUrl('/CARGOO/search?q=phone&category=1'); assertTest($safe1 === '/CARGOO/search?q=phone&category=1', 'Valid internal relative URL with query string is preserved'); // Valid relative URL without basePath $safe2 = $homeController->sanitizeRedirectUrl('/product/123'); assertTest($safe2 === '/CARGOO/product/123', 'Valid relative URL without base_path is normalized with Url::to'); // Valid same-origin absolute URL $safe3 = $homeController->sanitizeRedirectUrl('http://localhost/CARGOO/account/orders?status=pending'); assertTest($safe3 === 'http://localhost/CARGOO/account/orders?status=pending', 'Valid localhost absolute URL is preserved'); // Malicious External URL $bad1 = $homeController->sanitizeRedirectUrl('https://evil-phishing-site.com/steal-login'); assertTest($bad1 === '/CARGOO', 'Malicious external domain is blocked and redirected to homepage'); // Protocol-Relative URL $bad2 = $homeController->sanitizeRedirectUrl('//evil.com/phish'); assertTest($bad2 === '/CARGOO', 'Protocol-relative URL //evil.com is blocked'); // Backslash Protocol-Relative URL $bad3 = $homeController->sanitizeRedirectUrl('\\\\evil.com\\phish'); assertTest($bad3 === '/CARGOO', 'Backslash protocol-relative URL is blocked'); // JavaScript Pseudo-Protocol $bad4 = $homeController->sanitizeRedirectUrl('javascript:alert(document.cookie)'); assertTest($bad4 === '/CARGOO', 'javascript: URL is blocked'); // Data Pseudo-Protocol $bad5 = $homeController->sanitizeRedirectUrl('data:text/html,<script>alert(1)</script>'); assertTest($bad5 === '/CARGOO', 'data: URL is blocked'); // CRLF Injection $bad6 = $homeController->sanitizeRedirectUrl("/CARGOO/home\r\nSet-Cookie: evil=1"); assertTest($bad6 === '/CARGOO', 'CRLF injection in redirect URL is blocked'); // Language switch loop $bad7 = $homeController->sanitizeRedirectUrl('/CARGOO/language/en'); assertTest($bad7 === '/CARGOO', 'Redirect loop to language switch endpoint is prevented'); $bad8 = $homeController->sanitizeRedirectUrl('/CARGOO/set-language?lang=th'); assertTest($bad8 === '/CARGOO', 'Redirect loop to set-language endpoint is prevented'); echo PHP_EOL . "==========================================================" . PHP_EOL; echo "TEST SUITE: Apache & Directory Protection Configuration" . PHP_EOL; echo "==========================================================" . PHP_EOL; // Check .htaccess files exist and contain protection directives $rootHtaccess = file_get_contents(__DIR__ . '/../.htaccess'); assertTest(str_contains($rootHtaccess, 'Options -Indexes'), 'Root .htaccess contains Options -Indexes'); assertTest(str_contains($rootHtaccess, 'RewriteRule ^(app\|config\|database\|lang\|storage\|views\|scratch)'), 'Root .htaccess blocks sensitive directory direct access'); $sensitiveFolders = ['lang', 'config', 'app', 'database', 'storage', 'views']; foreach ($sensitiveFolders as $folder) { $folderHtaccess = __DIR__ . "/../{$folder}/.htaccess"; assertTest(file_exists($folderHtaccess), "{$folder}/.htaccess file exists"); if (file_exists($folderHtaccess)) { $content = file_get_contents($folderHtaccess); assertTest(str_contains($content, 'Require all denied') && str_contains($content, 'Options -Indexes'), "{$folder}/.htaccess contains Require all denied & Options -Indexes"); } } echo PHP_EOL . "==========================================================" . PHP_EOL; echo "TEST RESULTS SUMMARY: Passed: {$totalPassed} \| Failed: {$totalFailed}" . PHP_EOL; echo "==========================================================" . PHP_EOL; if ($totalFailed === 0) { echo ">>> ALL TESTS PASSED SUCCESSFULLY! <<<" . PHP_EOL; exit(0); } else { echo ">>> SOME TESTS FAILED! <<<" . PHP_EOL; exit(1); }

| ver. 1.4 | Github | . | PHP 7.4.33 | Generation time: 0.25 | proxy | phpinfo | Settings