setTables(array('editors' => array(array('username' => 'ed', 'password' => 'x', 'email' => '')))); $this->token = $this->loginAs(); } private function add(array $fields = array()): array { return $this->post('/publish/addeditor', $fields + array('adduser' => '1', 'username' => 'newbie', 'password' => 'pass word', 'email' => 'new@example.org', 'csrf_token' => $this->token)); } public function testVisitorsAreSentToTheLogin(): void { $this->cookies = array(); $this->assertRedirect('/publish/login', $this->get('/publish/addeditor')); $this->assertRedirect('/publish/login', $this->add(array('csrf_token' => ''))); $this->assertCount(1, $this->tables()['editors']); } public function testPlainHttpIsSentToHttps(): void { $this->assertRedirect('https://site.test/publish/addeditor', $this->get('/publish/addeditor', array('X-Test-Plain' => '1'))); } public function testTheFormHasTheToken(): void { $this->assertSame($this->token, $this->csrfToken($this->get('/publish/addeditor')['body'])); } public function testAnEditorIsAddedWithAPasswordHash(): void { $answer = $this->add(); $this->assertStringContainsString('

Added editor newbie

', $answer['body']); $row = $this->tables()['editors'][1]; $this->assertSame(array('newbie', 'new@example.org'), array($row['username'], $row['email'])); $this->assertTrue(password_verify('pass word', $row['password'])); } public function testTheTokenIsChecked(): void { $answer = $this->add(array('csrf_token' => 'wrong')); $this->assertStringContainsString('Your session has expired. Please try again.', $answer['body']); $this->assertCount(1, $this->tables()['editors']); } public function testAnExistingUsernameIsRefused(): void { $answer = $this->add(array('username' => 'ed')); $this->assertStringContainsString('An editor with that username already exists.', $answer['body']); $this->assertSame('x', $this->tables()['editors'][0]['password']); } public function testAHashThatDoesNotFitIsNotKept(): void { $this->setTables(array('editors' => array()), 40); $answer = $this->add(); $this->assertStringContainsString('the editors.password column is too short', $answer['body']); $this->assertSame(array(), $this->tables()['editors']); } public function testTheUsernameIsEscaped(): void { $body = $this->add(array('username' => 'x'))['body']; $this->assertStringContainsString('Added editor <b>x</b>', $body); } }