tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Check editor accounts.

Browse Source 
A new editor needs a username and a password of at least 12 characters. A persistent login needs an unexpired key and an existing account. Removing an account revokes its persistent logins, and its sessions end.
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent 5d657d7e45
commit 3df88e0b4c
10 changed files with 217 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/php/Pages/LoginTest.php
+28
View File
@@ -181,6 +181,34 @@ class LoginTest extends PageTestCase {
$this->assertStringNotContainsString('/publish/logout', $body);
}
public function testAnExpiredPersistentKeyDoesNotLogIn(): void {
$this->setTables(array('editors' => $this->tables()['editors'], 'persistent_sessions' => array(
array('username' => 'ed', 'session' => hash('sha256', 'key'), 'created' => gmdate('Y-m-d H:i:s', strtotime('-1 year -1 day'))))));
$this->cookies['PersistentAuth'] = 'ed|key';
$body = $this->get('/')['body'];
$this->assertStringNotContainsString('/publish/logout', $body);
$this->assertArrayNotHasKey('editor', $this->session());
// The expired key and its cookie are removed
$this->assertArrayNotHasKey('PersistentAuth', $this->cookies);
$this->assertSame(array(), $this->tables()['persistent_sessions']);
}
public function testAPersistentKeyOfARemovedAccountDoesNotLogIn(): void {
$this->setTables(array('persistent_sessions' => array(
array('username' => 'ed', 'session' => hash('sha256', 'key'), 'created' => gmdate('Y-m-d H:i:s')))));
$this->cookies['PersistentAuth'] = 'ed|key';
$this->assertStringNotContainsString('/publish/logout', $this->get('/')['body']);
$this->assertArrayNotHasKey('editor', $this->session());
$this->assertArrayNotHasKey('PersistentAuth', $this->cookies);
}
public function testARemovedAccountEndsItsSession(): void {
$this->loginAs();
$this->setTables(array());
$this->assertRedirect('/publish/login', $this->get('/publish/edit'));
$this->assertArrayNotHasKey('editor', $this->session());
}
public function testLogoutNeedsTheToken(): void {
$this->loginAs();
$this->assertRedirect('/', $this->get('/publish/logout?token=wrong'));