tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Check editor accounts.

Browse Source 
A new editor needs a username and a password of at least 12 characters. A persistent login needs an unexpired key and an existing account. Removing an account revokes its persistent logins, and its sessions end.
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent 5d657d7e45
commit 3df88e0b4c
10 changed files with 217 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/php/Pages/AddEditorTest.php
+36 -4
View File
@@ -1,6 +1,7 @@
<?php
namespace Xxx\Tests\Pages;
use PHPUnit\Framework\Attributes\DataProvider;
use Xxx\Tests\Support\PageTestCase;
// publish/addeditor.php
@@ -14,7 +15,7 @@ class AddEditorTest extends PageTestCase {
}
private function add(array $fields = array()): array {
return $this->post('/publish/addeditor', $fields + array('adduser' => '1', 'username' => 'newbie', 'password' => 'pass word',
return $this->post('/publish/addeditor', $fields + array('adduser' => '1', 'username' => 'newbie', 'password' => 'a long pass phrase',
'email' => 'new@example.org', 'csrf_token' => $this->token));
}
@@ -38,7 +39,7 @@ class AddEditorTest extends PageTestCase {
$this->assertStringContainsString('<p>Added editor newbie</p>', $answer['body']);
$row = $this->tables()['editors'][1];
$this->assertSame(array('newbie', 'new@example.org'), array($row['username'], $row['email']));
$this->assertTrue(password_verify('pass word', $row['password']));
$this->assertTrue(password_verify('a long pass phrase', $row['password']));
}
public function testTheTokenIsChecked(): void {
@@ -54,10 +55,41 @@ class AddEditorTest extends PageTestCase {
}
public function testAHashThatDoesNotFitIsNotKept(): void {
$this->setTables(array('editors' => array()), 40);
$this->setTables(array('editors' => array(array('username' => 'ed', 'password' => 'x', 'email' => ''))), 40);
$answer = $this->add();
$this->assertStringContainsString('the editors.password column is too short', $answer['body']);
$this->assertSame(array(), $this->tables()['editors']);
$this->assertSame(array('ed'), array_column($this->tables()['editors'], 'username'));
$this->assertCount(1, $this->queries('/^DELETE FROM persistent_sessions WHERE username = \?$/'));
}
public static function badAccounts(): array {
return array(
'no username' => array(array('username' => ''), 'Please enter a username.'),
'a blank username' => array(array('username' => ' '), 'Please enter a username.'),
'an array username' => array(array('username' => array('x')), 'Please enter a username.'),
'spaces at the ends' => array(array('username' => ' newbie'), 'no spaces at the ends'),
'a bar' => array(array('username' => 'new|bie'), 'no spaces at the ends'),
'a long username' => array(array('username' => str_repeat('n', 65)), 'at most 64 characters'),
'no password' => array(array('password' => ''), 'A password needs at least 12 characters.'),
'a short password' => array(array('password' => 'eleven char'), 'A password needs at least 12 characters.'),
'an array password' => array(array('password' => array('a long pass phrase')), 'A password needs at least 12 characters.'),
'a huge password' => array(array('password' => str_repeat('p', 1025)), 'A password has at most 1024 characters.'),
'the username' => array(array('username' => 'newbie-editor', 'password' => 'NEWBIE-EDITOR'), 'The password cannot be the username.'),
);
}
#[DataProvider('badAccounts')]
public function testABadAccountIsRefused(array $fields, string $message): void {
$answer = $this->add($fields);
$this->assertSame(200, $answer['status']);
$this->assertStringContainsString(htmlspecialchars($message, ENT_QUOTES), $answer['body']);
$this->assertStringNotContainsString('Added editor', $answer['body']);
$this->assertCount(1, $this->tables()['editors']);
$this->assertCount(0, $this->queries('/^INSERT INTO editors/'));
}
public function testTwelveCharactersAreEnough(): void {
$this->assertStringContainsString('Added editor newbie', $this->add(array('password' => 'twelve chars'))['body']);
}
public function testTheUsernameIsEscaped(): void {
tests/php/Pages/FeedAndImageTest.php
+6
View File
@@ -68,6 +68,12 @@ class FeedAndImageTest extends PageTestCase {
$this->assertSame(200, $this->get('/display?id=3')['status']);
}
public function testARemovedEditorSeesNoHiddenImages(): void {
$this->loginAs();
$this->setTables(array('xxx' => $this->tables()['xxx']));
$this->assertSame(404, $this->get('/display?id=3')['status']);
}
public function testQueuedImagesNeedPermission(): void {
$this->assertSame(401, $this->get('/display?id=9&queue=1')['status']);
$this->startSession(array('allow_queue_image' => '8'));
tests/php/Pages/LoginTest.php
+28
View File
@@ -181,6 +181,34 @@ class LoginTest extends PageTestCase {
$this->assertStringNotContainsString('/publish/logout', $body);
}
public function testAnExpiredPersistentKeyDoesNotLogIn(): void {
$this->setTables(array('editors' => $this->tables()['editors'], 'persistent_sessions' => array(
array('username' => 'ed', 'session' => hash('sha256', 'key'), 'created' => gmdate('Y-m-d H:i:s', strtotime('-1 year -1 day'))))));
$this->cookies['PersistentAuth'] = 'ed|key';
$body = $this->get('/')['body'];
$this->assertStringNotContainsString('/publish/logout', $body);
$this->assertArrayNotHasKey('editor', $this->session());
// The expired key and its cookie are removed
$this->assertArrayNotHasKey('PersistentAuth', $this->cookies);
$this->assertSame(array(), $this->tables()['persistent_sessions']);
}
public function testAPersistentKeyOfARemovedAccountDoesNotLogIn(): void {
$this->setTables(array('persistent_sessions' => array(
array('username' => 'ed', 'session' => hash('sha256', 'key'), 'created' => gmdate('Y-m-d H:i:s')))));
$this->cookies['PersistentAuth'] = 'ed|key';
$this->assertStringNotContainsString('/publish/logout', $this->get('/')['body']);
$this->assertArrayNotHasKey('editor', $this->session());
$this->assertArrayNotHasKey('PersistentAuth', $this->cookies);
}
public function testARemovedAccountEndsItsSession(): void {
$this->loginAs();
$this->setTables(array());
$this->assertRedirect('/publish/login', $this->get('/publish/edit'));
$this->assertArrayNotHasKey('editor', $this->session());
}
public function testLogoutNeedsTheToken(): void {
$this->loginAs();
$this->assertRedirect('/', $this->get('/publish/logout?token=wrong'));
tests/php/Support/PageTestCase.php
+10 -1
View File
@@ -124,8 +124,17 @@ abstract class PageTestCase extends \PHPUnit\Framework\TestCase {
return $id;
}
// An editor's session, with a CSRF token; returns the token
/*
* An editor's session, with a CSRF token; returns the token. The pages
* log out an editor without an account, so this adds the account to the
* editors table if it is missing.
*/
protected function loginAs(string $username = 'ed', array $data = array()): string {
$saved = unserialize(file_get_contents(self::$state . '/tables.ser'));
if (!in_array($username, array_column($saved['tables']['editors'], 'username'), TRUE)) {
$saved['tables']['editors'][] = array('username' => $username, 'password' => '', 'email' => '');
file_put_contents(self::$state . '/tables.ser', serialize($saved));
}
$token = str_repeat('c0ffee', 10) . 'c0de';
$this->startSession($data + array('editor' => $username, 'csrf_token' => $token));
return $token;
tests/php/Support/SiteData.php
+16
View File
@@ -75,6 +75,22 @@ class SiteData {
return $row['username'] === $params[0] && $row['session'] === $params[1];
})), 0, 1);
});
FakeDb::on('/^SELECT p\.username, p\.session FROM persistent_sessions p JOIN editors e ON e\.username = p\.username\s+WHERE p\.username = \? AND p\.session = \? AND p\.created > DATE_SUB\(now\(\), INTERVAL 1 YEAR\)/', function ($sql, $params) {
$editors = array_column(self::$tables['editors'], 'username');
$limit = gmdate('Y-m-d H:i:s', strtotime('-1 year'));
return array_slice(array_values(array_map(function ($row) {
return array('username' => $row['username'], 'session' => $row['session']);
}, array_filter(self::$tables['persistent_sessions'], function ($row) use ($params, $editors, $limit) {
return $row['username'] === $params[0] && $row['session'] === $params[1]
&& in_array($row['username'], $editors, TRUE) && ($row['created'] ?? $limit) > $limit;
}))), 0, 1);
});
FakeDb::on('/^DELETE FROM persistent_sessions WHERE username = \?$/', function ($sql, $params) {
self::$tables['persistent_sessions'] = array_values(array_filter(self::$tables['persistent_sessions'], function ($row) use ($params) {
return $row['username'] !== $params[0];
}));
return TRUE;
});
FakeDb::on('/^INSERT INTO persistent_sessions \(username, session\) VALUES \(\?, \?\)/', function ($sql, $params) {
self::$tables['persistent_sessions'][] = array('username' => $params[0], 'session' => $params[1], 'created' => gmdate('Y-m-d H:i:s'));
return TRUE;
tests/php/Unit/SessionTest.php
+49 -2
View File
@@ -127,6 +127,7 @@ class SessionTest extends TestCase {
}
public function testCheckPersistentLoginLogsInAndSwapsTheKey(): void {
SiteData::$tables['editors'][] = array('username' => 'ed', 'password' => '', 'email' => '');
session_start();
$before = session_id();
SiteData::$tables['persistent_sessions'][] = array('username' => 'ed', 'session' => persistent_key_hash('key'), 'created' => gmdate('Y-m-d H:i:s'));
@@ -139,6 +140,52 @@ class SessionTest extends TestCase {
$this->assertNotSame(persistent_key_hash('key'), $rows[0]['session'], 'the used key is gone');
}
public function testCheckPersistentLoginRefusesAnExpiredKey(): void {
SiteData::$tables['editors'][] = array('username' => 'ed', 'password' => '', 'email' => '');
SiteData::$tables['persistent_sessions'][] = array('username' => 'ed', 'session' => persistent_key_hash('key'),
'created' => gmdate('Y-m-d H:i:s', strtotime('-1 year -1 day')));
$_COOKIE['PersistentAuth'] = 'ed|key';
$this->assertFalse(check_persistent_login());
$this->assertArrayNotHasKey('editor', $_SESSION ?? array());
$this->assertSame(array(), SiteData::$tables['persistent_sessions']);
}
public function testCheckPersistentLoginRefusesAKeyWithoutAnAccount(): void {
SiteData::$tables['persistent_sessions'][] = array('username' => 'ed', 'session' => persistent_key_hash('key'), 'created' => gmdate('Y-m-d H:i:s'));
$_COOKIE['PersistentAuth'] = 'ed|key';
$this->assertFalse(check_persistent_login());
$this->assertSame(array(), SiteData::$tables['persistent_sessions']);
}
public function testEditorExists(): void {
SiteData::$tables['editors'][] = array('username' => 'ed', 'password' => '', 'email' => '');
$this->assertTrue(editor_exists('ed'));
$this->assertFalse(editor_exists('ann'));
$this->assertFalse(editor_exists(''));
$this->assertFalse(editor_exists(array('ed')));
$this->assertNull($GLOBALS['db'], 'the connection is closed again');
}
public function testRemoveEditorRevokesItsPersistentLogins(): void {
SiteData::$tables['editors'] = array(array('username' => 'ed', 'password' => '', 'email' => ''),
array('username' => 'ann', 'password' => '', 'email' => ''));
SiteData::$tables['persistent_sessions'] = array(
array('username' => 'ed', 'session' => persistent_key_hash('one'), 'created' => gmdate('Y-m-d H:i:s')),
array('username' => 'ed', 'session' => persistent_key_hash('two'), 'created' => gmdate('Y-m-d H:i:s')),
array('username' => 'ann', 'session' => persistent_key_hash('three'), 'created' => gmdate('Y-m-d H:i:s')));
remove_editor('ed');
$this->assertSame(array('ann'), array_column(SiteData::$tables['editors'], 'username'));
$this->assertSame(array('ann'), array_column(SiteData::$tables['persistent_sessions'], 'username'));
}
public function testARemovedEditorIsLoggedOutOverHttps(): void {
$code = 'Xxx\Tests\Support\SiteData::install(); $_SERVER["HTTPS"] = "on"; session_id("abc123"); session_start(); $_SESSION["editor"] = "ed"; session_write_close();'
. ' $_COOKIE[session_name()] = "abc123"; include XXX_ROOT . "/session.lib.php";'
. ' echo json_encode(array($is_admin, $_SESSION["editor"] ?? NULL));';
$result = PhpProcess::runBare($code, array(), array('session.save_path' => $this->tmp, 'session.use_cookies' => '0', 'session.cache_limiter' => ''));
$this->assertSame('[false,null]', $result['stdout'], $result['stderr']);
}
public function testDeletePersistentLoginRemovesThisKeyAndOldKeys(): void {
SiteData::$tables['persistent_sessions'] = array(
array('username' => 'ed', 'session' => persistent_key_hash('mine'), 'created' => gmdate('Y-m-d H:i:s')),
@@ -160,7 +207,7 @@ class SessionTest extends TestCase {
// The top of session.lib.php runs on every page; it needs HTTPS and a session
public function testSessionStartsOnlyOverHttps(): void {
$code = '$_SERVER["HTTPS"] = %s; session_id("abc123"); session_start(); $_SESSION["editor"] = "ed"; session_write_close();'
$code = 'Xxx\Tests\Support\SiteData::install(array("editors" => array(array("username" => "ed")))); $_SERVER["HTTPS"] = %s; session_id("abc123"); session_start(); $_SESSION["editor"] = "ed"; session_write_close();'
. ' $_COOKIE[session_name()] = "abc123"; include XXX_ROOT . "/session.lib.php";'
. ' echo json_encode(array($is_admin, $username ?? NULL, session_status() === PHP_SESSION_ACTIVE));';
$ini = array('session.save_path' => $this->tmp, 'session.use_cookies' => '0', 'session.cache_limiter' => '');
@@ -176,7 +223,7 @@ class SessionTest extends TestCase {
public function testPersistentCookieLogsInOverHttps(): void {
$store = $this->tmp . '/tables.json';
file_put_contents($store, json_encode(array('persistent_sessions' => array(
file_put_contents($store, json_encode(array('editors' => array(array('username' => 'ed')), 'persistent_sessions' => array(
array('username' => 'ed', 'session' => persistent_key_hash('key'), 'created' => gmdate('Y-m-d H:i:s'))))));
$code = 'Xxx\Tests\Support\SiteData::install(json_decode(file_get_contents(' . var_export($store, TRUE) . '), TRUE));'
. ' $_SERVER["HTTPS"] = "on"; $_COOKIE["PersistentAuth"] = "ed|key"; include XXX_ROOT . "/session.lib.php";'