Security update for Core, with self-updated composer

[yaffs-website] / web / core / tests / Drupal / FunctionalTests / HttpKernel / CorsIntegrationTest.php

diff --git a/web/core/tests/Drupal/FunctionalTests/HttpKernel/CorsIntegrationTest.php b/web/core/tests/Drupal/FunctionalTests/HttpKernel/CorsIntegrationTest.php
index c29324a013512a78d935629464e2e3484b3cedab..c8748342fb72d6d3c0372ef50bcf300304f49b9c 100644 (file)
--- a/web/core/tests/Drupal/FunctionalTests/HttpKernel/CorsIntegrationTest.php
+++ b/web/core/tests/Drupal/FunctionalTests/HttpKernel/CorsIntegrationTest.php
@@ -2,6 +2,7 @@
 
 namespace Drupal\FunctionalTests\HttpKernel;
 
+use Drupal\Core\Url;
 use Drupal\Tests\BrowserTestBase;
 
 /**
@@ -72,6 +73,19 @@ class CorsIntegrationTest extends BrowserTestBase {
     $this->drupalGet('/test-page', [], ['Origin' => 'http://example.com']);
     $this->assertSession()->statusCodeEquals(200);
     $this->assertSession()->responseHeaderEquals('Access-Control-Allow-Origin', 'http://example.com');
+
+    // Verify POST still functions with 'Origin' header set to site's domain.
+    $origin = \Drupal::request()->getSchemeAndHttpHost();
+
+    /** @var \GuzzleHttp\ClientInterface $httpClient */
+    $httpClient = $this->getSession()->getDriver()->getClient()->getClient();
+    $url = Url::fromUri('base:/test-page');
+    $response = $httpClient->request('POST', $url->setAbsolute()->toString(), [
+      'headers' => [
+        'Origin' => $origin,
+      ]
+    ]);
+    $this->assertEquals(200, $response->getStatusCode());
   }
 
 }