File manager - Edit - /home/webapp69.cm.in.th/u69319090039/Shop39/public/test_tracking.php
Back
<?php // Test script to verify Order Tracking API response and ownership security $ch = curl_init('http://localhost/shop/login'); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_COOKIEJAR, __DIR__ . '/cookie_seller.txt'); curl_setopt($ch, CURLOPT_COOKIEFILE, __DIR__ . '/cookie_seller.txt'); $res = curl_exec($ch); preg_match('/name="csrf_token" value="([^"]+)"/', $res, $m); $csrf = $m[1] ?? ''; // Login as seller (User ID 3, owner of Order 3) curl_setopt($ch, CURLOPT_URL, 'http://localhost/shop/login'); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(['csrf_token' => $csrf, 'username' => 'seller', 'password' => 'Seller@123'])); curl_exec($ch); // Test 1: Fetch Order 3 tracking (Owner access) curl_setopt($ch, CURLOPT_URL, 'http://localhost/shop/orders/3/tracking'); curl_setopt($ch, CURLOPT_HTTPGET, true); $res1 = curl_exec($ch); echo "=== Test 1: Owner accessing Order 3 tracking ===\n" . $res1 . "\n\n"; // Test 2: Try to fetch Order 1 tracking (Order 1 belongs to user_id=2, but logged in as user_id=3) curl_setopt($ch, CURLOPT_URL, 'http://localhost/shop/orders/1/tracking'); $res2 = curl_exec($ch); $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE); echo "=== Test 2: Security check - Owner trying to access Order 1 (HTTP {$httpCode}) ===\n" . $res2 . "\n\n";
| ver. 1.4 |
Github
|
.
| PHP 7.4.33 | Generation time: 0.3 |
proxy
|
phpinfo
|
Settings