Add test(s) for SA-CORE-2023-004 [D7]

Thanks for adding the test. Was tempted to mark this RTBC, but checked this manually and it seems like that in PHP 5.6 and lower, these variables starts with _ instead of $...

See the phpinfo() from tests:

PHP 8.1 - https://dispatcher.drupalci.org/job/drupal_d7/258944/artifact/jenkins-drupal_d7-258944/artifacts/runcontainers/phpinfo.txt

PHP Variables

Variable => Value
$_SERVER['HOSTNAME'] => b4012e56c7b7
$_SERVER['PHP_VERSION'] => 8.1.16
...

PHP 7.0 - https://dispatcher.drupalci.org/job/drupal_d7/252165/artifact/jenkins-drupal_d7-252165/artifacts/runcontainers/phpinfo.txt

PHP Variables

Variable => Value
$_SERVER['DRUPALCI'] => TRUE
$_SERVER['HOSTNAME'] => ea704a8ad052
$_SERVER['PHP_VERSION'] => 7.0.33
...

PHP 5.6 - https://dispatcher.drupalci.org/job/drupal_d7/258937/artifact/jenkins-drupal_d7-258937/artifacts/runcontainers/phpinfo.txt

PHP Variables

Variable => Value
_SERVER["DRUPALCI"] => TRUE
_SERVER["HOSTNAME"] => eefd6dc1fd5f
_SERVER["PHP_VERSION"] => 5.6.37
...

Therefore I think this test would not work in PHP 5.6 and lower (it won't find anything even if the removal is not working and the cookie is there), because we are searching for $_COOKIE.

Verified this on one PHP 5.6 Apache server without the SA update and it seems like this observation is correct, as there is:

PHP Variables

_COOKIE["has_js"]	1
_COOKIE["SSESS98af7999faf14dcd00cfcc373d4999b3"]	YYY
_COOKIE["PHPSESSIDx"]	XXX

So no $_COOKIE only _COOKIE.

We probably have two options:
1. leave it as it is
2. search for something else - maybe the whole PHP Variables section?

We cannot search for _COOKIE, because this string is displayed multiple times on that page even after SA-CORE-2023-004.

Or we can probably search for _COOKIE[, even if it doesn't look extra nice.

Thanks, I think that's a good suggestion.

Per 🌱 [meta] Should Drupal 7 drop support for older PHP versions? Active I think we're quite likely to stop testing on PHP 5.x some time in the not-too-distant future, but this is a simple change we could make to ensure tests don't break on old PHP for a really trivial reason.

LGTM, thanks!

I verified manually that the test failed without the new flags passed to phpinfo():

---- SystemAdminTestCase ----


Status    Group      Filename          Line Function                            
--------------------------------------------------------------------------------
Fail      Other      system.test       2879 SystemAdminTestCase->testAdminPhpIn
    "_COOKIE[" not found

Committing this means we can now add to these tests in 📌 Make phpinfo on the admin status report configurable [D7] Fixed as discussed in that issue.

Thanks!

Automatically closed - issue fixed for 2 weeks with no activity.