bachir/Clameurs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

updated core to 7.53

Browse Source
This commit is contained in:
Bachir Soussi Chiadmi
2016-12-23 10:39:24 +01:00
parent e7aa033981
commit 400dd6e9f4
337 changed files with 9443 additions and 2570 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/user/user.test
+204 -9
View File
@@ -480,6 +480,34 @@ class UserPasswordResetTestCase extends DrupalWebTestCase {
$this->assertText(t('Further instructions have been sent to your e-mail address.'), 'Password reset instructions mailed message displayed.');
}
/**
* Test user password reset while logged in.
*/
function testUserPasswordResetLoggedIn() {
$account = $this->drupalCreateUser();
$this->drupalLogin($account);
// Make sure the test account has a valid password.
user_save($account, array('pass' => user_password()));
// Generate one time login link.
$reset_url = user_pass_reset_url($account);
$this->drupalGet($reset_url);
$this->assertText('Reset password');
$this->drupalPost(NULL, NULL, t('Log in'));
$this->assertText('You have just used your one-time login link. It is no longer necessary to use this link to log in. Please change your password.');
$pass = user_password();
$edit = array(
'pass[pass1]' => $pass,
'pass[pass2]' => $pass,
);
$this->drupalPost(NULL, $edit, t('Save'));
$this->assertText('The changes have been saved.');
}
/**
* Attempts login using an expired password reset link.
*/
@@ -498,7 +526,7 @@ class UserPasswordResetTestCase extends DrupalWebTestCase {
// To attempt an expired password reset, create a password reset link as if
// its request time was 60 seconds older than the allowed limit of timeout.
$bogus_timestamp = REQUEST_TIME - variable_get('user_password_reset_timeout', 86400) - 60;
$this->drupalGet("user/reset/$account->uid/$bogus_timestamp/" . user_pass_rehash($account->pass, $bogus_timestamp, $account->login));
$this->drupalGet("user/reset/$account->uid/$bogus_timestamp/" . user_pass_rehash($account->pass, $bogus_timestamp, $account->login, $account->uid));
$this->assertText(t('You have tried to use a one-time login link that has expired. Please request a new one using the form below.'), 'Expired password reset request rejected.');
}
@@ -519,6 +547,74 @@ class UserPasswordResetTestCase extends DrupalWebTestCase {
$this->assertFieldByName('name', $edit['name'], 'User name found.');
}
/**
* Make sure that users cannot forge password reset URLs of other users.
*/
function testResetImpersonation() {
// Make sure user 1 has a valid password, so it does not interfere with the
// test user accounts that are created below.
$account = user_load(1);
user_save($account, array('pass' => user_password()));
// Create two identical user accounts except for the user name. They must
// have the same empty password, so we can't use $this->drupalCreateUser().
$edit = array();
$edit['name'] = $this->randomName();
$edit['mail'] = $edit['name'] . '@example.com';
$edit['status'] = 1;
$user1 = user_save(drupal_anonymous_user(), $edit);
$edit['name'] = $this->randomName();
$user2 = user_save(drupal_anonymous_user(), $edit);
// The password reset URL must not be valid for the second user when only
// the user ID is changed in the URL.
$reset_url = user_pass_reset_url($user1);
$attack_reset_url = str_replace("user/reset/$user1->uid", "user/reset/$user2->uid", $reset_url);
$this->drupalGet($attack_reset_url);
$this->assertNoText($user2->name, 'The invalid password reset page does not show the user name.');
$this->assertUrl('user/password', array(), 'The user is redirected to the password reset request page.');
$this->assertText('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.');
// When legacy code calls user_pass_rehash() without providing the $uid
// parameter, neither password reset URL should be valid since it is
// impossible for the system to determine which user account the token was
// intended for.
$timestamp = REQUEST_TIME;
// Pass an explicit NULL for the $uid parameter of user_pass_rehash()
// rather than not passing it at all, to avoid triggering PHP warnings in
// the test.
$reset_url_token = user_pass_rehash($user1->pass, $timestamp, $user1->login, NULL);
$reset_url = url("user/reset/$user1->uid/$timestamp/$reset_url_token", array('absolute' => TRUE));
$this->drupalGet($reset_url);
$this->assertNoText($user1->name, 'The invalid password reset page does not show the user name.');
$this->assertUrl('user/password', array(), 'The user is redirected to the password reset request page.');
$this->assertText('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.');
$attack_reset_url = str_replace("user/reset/$user1->uid", "user/reset/$user2->uid", $reset_url);
$this->drupalGet($attack_reset_url);
$this->assertNoText($user2->name, 'The invalid password reset page does not show the user name.');
$this->assertUrl('user/password', array(), 'The user is redirected to the password reset request page.');
$this->assertText('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.');
// To verify that user_pass_rehash() never returns a valid result in the
// above situation (even if legacy code also called it to attempt to
// validate the token, rather than just to generate the URL), check that a
// second call with the same parameters produces a different result.
$new_reset_url_token = user_pass_rehash($user1->pass, $timestamp, $user1->login, NULL);
$this->assertNotEqual($reset_url_token, $new_reset_url_token);
// However, when the duplicate account is removed, the password reset URL
// should be valid.
user_delete($user2->uid);
$reset_url_token = user_pass_rehash($user1->pass, $timestamp, $user1->login, NULL);
$reset_url = url("user/reset/$user1->uid/$timestamp/$reset_url_token", array('absolute' => TRUE));
$this->drupalGet($reset_url);
$this->assertText($user1->name, 'The valid password reset page shows the user name.');
$this->assertUrl($reset_url, array(), 'The user remains on the password reset login page.');
$this->assertNoText('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.');
}
}
/**
@@ -558,7 +654,7 @@ class UserCancelTestCase extends DrupalWebTestCase {
// Attempt bogus account cancellation request confirmation.
$timestamp = $account->login;
$this->drupalGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login));
$this->drupalGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid));
$this->assertResponse(403, 'Bogus cancelling request rejected.');
$account = user_load($account->uid);
$this->assertTrue($account->status == 1, 'User account was not canceled.');
@@ -631,14 +727,14 @@ class UserCancelTestCase extends DrupalWebTestCase {
// Attempt bogus account cancellation request confirmation.
$bogus_timestamp = $timestamp + 60;
$this->drupalGet("user/$account->uid/cancel/confirm/$bogus_timestamp/" . user_pass_rehash($account->pass, $bogus_timestamp, $account->login));
$this->drupalGet("user/$account->uid/cancel/confirm/$bogus_timestamp/" . user_pass_rehash($account->pass, $bogus_timestamp, $account->login, $account->uid));
$this->assertText(t('You have tried to use an account cancellation link that has expired. Please request a new one using the form below.'), 'Bogus cancelling request rejected.');
$account = user_load($account->uid);
$this->assertTrue($account->status == 1, 'User account was not canceled.');
// Attempt expired account cancellation request confirmation.
$bogus_timestamp = $timestamp - 86400 - 60;
$this->drupalGet("user/$account->uid/cancel/confirm/$bogus_timestamp/" . user_pass_rehash($account->pass, $bogus_timestamp, $account->login));
$this->drupalGet("user/$account->uid/cancel/confirm/$bogus_timestamp/" . user_pass_rehash($account->pass, $bogus_timestamp, $account->login, $account->uid));
$this->assertText(t('You have tried to use an account cancellation link that has expired. Please request a new one using the form below.'), 'Expired cancel account request rejected.');
$accounts = user_load_multiple(array($account->uid), array('status' => 1));
$this->assertTrue(reset($accounts), 'User account was not canceled.');
@@ -675,7 +771,7 @@ class UserCancelTestCase extends DrupalWebTestCase {
$this->assertText(t('A confirmation request to cancel your account has been sent to your e-mail address.'), 'Account cancellation request mailed message displayed.');
// Confirm account cancellation request.
$this->drupalGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login));
$this->drupalGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid));
$account = user_load($account->uid, TRUE);
$this->assertTrue($account->status == 0, 'User has been blocked.');
@@ -713,7 +809,7 @@ class UserCancelTestCase extends DrupalWebTestCase {
$this->assertText(t('A confirmation request to cancel your account has been sent to your e-mail address.'), 'Account cancellation request mailed message displayed.');
// Confirm account cancellation request.
$this->drupalGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login));
$this->drupalGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid));
$account = user_load($account->uid, TRUE);
$this->assertTrue($account->status == 0, 'User has been blocked.');
@@ -763,7 +859,7 @@ class UserCancelTestCase extends DrupalWebTestCase {
$this->assertText(t('A confirmation request to cancel your account has been sent to your e-mail address.'), 'Account cancellation request mailed message displayed.');
// Confirm account cancellation request.
$this->drupalGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login));
$this->drupalGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid));
$this->assertFalse(user_load($account->uid, TRUE), 'User is not found in the database.');
// Confirm that user's content has been attributed to anonymous user.
@@ -827,7 +923,7 @@ class UserCancelTestCase extends DrupalWebTestCase {
$this->assertText(t('A confirmation request to cancel your account has been sent to your e-mail address.'), 'Account cancellation request mailed message displayed.');
// Confirm account cancellation request.
$this->drupalGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login));
$this->drupalGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid));
$this->assertFalse(user_load($account->uid, TRUE), 'User is not found in the database.');
// Confirm that user's content has been deleted.
@@ -1781,6 +1877,19 @@ class UserCreateTestCase extends DrupalWebTestCase {
$this->drupalGet('admin/people');
$this->assertText($edit['name'], 'User found in list of users');
}
// Test that the password '0' is considered a password.
$name = $this->randomName();
$edit = array(
'name' => $name,
'mail' => $name . '@example.com',
'pass[pass1]' => 0,
'pass[pass2]' => 0,
'notify' => FALSE,
);
$this->drupalPost('admin/people/create', $edit, t('Create new account'));
$this->assertText(t('Created a new user account for @name. No e-mail has been sent.', array('@name' => $edit['name'])), 'User created with password 0');
$this->assertNoText('Password field is required');
}
}
@@ -1858,6 +1967,74 @@ class UserEditTestCase extends DrupalWebTestCase {
$this->drupalLogin($user1);
$this->drupalLogout();
}
/**
* Tests setting the password to "0".
*/
public function testUserWith0Password() {
$admin = $this->drupalCreateUser(array('administer users'));
$this->drupalLogin($admin);
// Create a regular user.
$user1 = $this->drupalCreateUser(array());
$edit = array('pass[pass1]' => '0', 'pass[pass2]' => '0');
$this->drupalPost("user/" . $user1->uid . "/edit", $edit, t('Save'));
$this->assertRaw(t("The changes have been saved."));
$this->drupalLogout();
$user1->pass_raw = '0';
$this->drupalLogin($user1);
$this->drupalLogout();
}
}
/**
* Tests editing a user account with and without a form rebuild.
*/
class UserEditRebuildTestCase extends DrupalWebTestCase {
public static function getInfo() {
return array(
'name' => 'User edit with form rebuild',
'description' => 'Test user edit page when a form rebuild is triggered.',
'group' => 'User',
);
}
function setUp() {
parent::setUp('user_form_test');
}
/**
* Test user edit page when the form is set to rebuild.
*/
function testUserEditFormRebuild() {
$user1 = $this->drupalCreateUser(array('change own username'));
$this->drupalLogin($user1);
$roles = array_keys($user1->roles);
// Save the user form twice.
$edit = array();
$edit['current_pass'] = $user1->pass_raw;
$this->drupalPost("user/$user1->uid/edit", $edit, t('Save'));
$this->assertRaw(t("The changes have been saved."));
$this->drupalPost(NULL, $edit, t('Save'));
$this->assertRaw(t("The changes have been saved."));
$saved_user1 = entity_load_unchanged('user', $user1->uid);
$this->assertEqual(count($roles), count($saved_user1->roles), 'Count of user roles in database matches original count.');
$diff = array_diff(array_keys($saved_user1->roles), $roles);
$this->assertTrue(empty($diff), format_string('User roles in database match original: @roles', array('@roles' => implode(', ', $saved_user1->roles))));
// Set variable that causes the form to be rebuilt in user_form_test.module.
variable_set('user_form_test_user_profile_form_rebuild', TRUE);
$this->drupalPost("user/$user1->uid/edit", $edit, t('Save'));
$this->assertRaw(t("The changes have been saved."));
$this->drupalPost(NULL, $edit, t('Save'));
$this->assertRaw(t("The changes have been saved."));
$saved_user1 = entity_load_unchanged('user', $user1->uid);
$this->assertEqual(count($roles), count($saved_user1->roles), 'Count of user roles in database matches original count.');
$diff = array_diff(array_keys($saved_user1->roles), $roles);
$this->assertTrue(empty($diff), format_string('User roles in database match original: @roles', array('@roles' => implode(', ', $saved_user1->roles))));
}
}
/**
@@ -2027,12 +2204,16 @@ class UserRoleAdminTestCase extends DrupalWebTestCase {
$this->assertFalse(user_role_load_by_name($old_name), 'The role can no longer be retrieved from the database using its old name.');
$this->assertTrue(is_object(user_role_load_by_name($role_name)), 'The role can be retrieved from the database using its new name.');
// Test deleting a role.
// Test deleting the default administrator role.
$role_name = 'administrator';
$role = user_role_load_by_name($role_name);
$this->drupalPost("admin/people/permissions/roles/edit/{$role->rid}", NULL, t('Delete role'));
$this->drupalPost(NULL, NULL, t('Delete'));
$this->assertText(t('The role has been deleted.'), 'The role has been deleted');
$this->assertNoLinkByHref("admin/people/permissions/roles/edit/{$role->rid}", 'Role edit link removed.');
$this->assertFalse(user_role_load_by_name($role_name), 'A deleted role can no longer be loaded.');
// Make sure this role is no longer configured as the administrator role.
$this->assertNull(variable_get('user_admin_role'), 'The administrator role is no longer configured as the administrator role.');
// Make sure that the system-defined roles cannot be edited via the user
// interface.
@@ -2158,6 +2339,20 @@ class UserUserSearchTestCase extends DrupalWebTestCase {
$this->drupalPost('search/user/', $edit, t('Search'));
$this->assertText($keys);
// Verify that wildcard search works.
$keys = $user1->name;
$keys = substr($keys, 0, 2) . '*' . substr($keys, 4, 2);
$edit = array('keys' => $keys);
$this->drupalPost('search/user/', $edit, t('Search'));
$this->assertText($user1->name, 'Search for username wildcard resulted in user name on page for administrative user.');
// Verify that wildcard search works for email.
$keys = $user1->mail;
$keys = substr($keys, 0, 2) . '*' . substr($keys, 4, 2);
$edit = array('keys' => $keys);
$this->drupalPost('search/user/', $edit, t('Search'));
$this->assertText($user1->name, 'Search for email wildcard resulted in user name on page for administrative user.');
// Create a blocked user.
$blocked_user = $this->drupalCreateUser();
$edit = array('status' => 0);