108 lines
5.8 KiB
PHP
108 lines
5.8 KiB
PHP
<?php
|
|
namespace Xxx\Tests\Pages;
|
|
|
|
use Xxx\Tests\Support\PageTestCase;
|
|
|
|
// Sending a story from publish/ as a visitor
|
|
class SubmitTest extends PageTestCase {
|
|
protected function setUp(): void {
|
|
parent::setUp();
|
|
$this->setTables(array('xxx' => array(array('id' => 1, 'title' => 'Live'))));
|
|
}
|
|
|
|
private function story(array $fields = array()): array {
|
|
return $fields + array('title' => 'My story', 'author' => 'Vi', 'email' => 'vi@example.org',
|
|
'story' => '<p>Once -- upon a "time"<script>x()</script>.</p>');
|
|
}
|
|
|
|
public function testPlainHttpIsSentToHttps(): void {
|
|
$this->assertRedirect('https://xxx.org.za/publish', $this->get('/publish', array('X-Test-Plain' => '1')));
|
|
}
|
|
|
|
public function testTheFormHasATokenAndTheCaptcha(): void {
|
|
$page = $this->get('/publish');
|
|
$this->assertSame(200, $page['status']);
|
|
$this->assertSame($this->session()['csrf_token'], $this->csrfToken($page['body']));
|
|
$this->assertStringContainsString('<div class="g-recaptcha" data-sitekey="test-site-key"></div>', $page['body']);
|
|
$this->assertStringContainsString('https://www.google.com/recaptcha/api.js', $page['body']);
|
|
$this->assertStringContainsString('<script type="text/javascript" src="../publish/editor.js"></script>', $page['body']);
|
|
}
|
|
|
|
public function testEditorsGetNoCaptcha(): void {
|
|
$this->loginAs();
|
|
$body = $this->get('/publish')['body'];
|
|
$this->assertStringNotContainsString('recaptcha', $body);
|
|
}
|
|
|
|
public function testPreviewThenSubmitAddsTheStoryToTheQueue(): void {
|
|
$token = $this->csrfToken($this->get('/publish')['body']);
|
|
$preview = $this->post('/publish', $this->story(array('action' => 'preview', 'csrf_token' => $token, 'g-recaptcha-response' => 'pass')));
|
|
$this->assertStringContainsString('Please review your submission.', $preview['body']);
|
|
// The preview shows the purified story; the typography comes when it is saved
|
|
$this->assertStringContainsString('<p>Once -- upon a "time".</p>', $preview['body']);
|
|
$this->assertStringContainsString('<button type="submit" id="submit" name="action" value="submit">', $preview['body']);
|
|
// The solved captcha lasts until the story is saved
|
|
$this->assertStringNotContainsString('g-recaptcha', $preview['body']);
|
|
$this->assertSame(array(), $this->queries('/^INSERT/'));
|
|
|
|
$this->post('/publish', $this->story(array('action' => 'submit', 'csrf_token' => $token)));
|
|
$tables = $this->tables();
|
|
$this->assertCount(1, $tables['xxx']);
|
|
$this->assertCount(1, $tables['queue']);
|
|
$row = $tables['queue'][0];
|
|
$this->assertSame(array('My story', 'Vi', 'vi@example.org', '<p>Once — upon a “time”.</p>', 'original author', 0),
|
|
array($row['title'], $row['author'], $row['email'], $row['story'], $row['editor'], $row['hidden']));
|
|
$session = $this->session();
|
|
$this->assertArrayNotHasKey('captcha_ok', $session);
|
|
$this->assertSame($row['id'], (string)$session['allow_queue_image']);
|
|
|
|
$mails = $this->mails();
|
|
$this->assertCount(1, $mails);
|
|
$this->assertSame('New submission: My story', $mails[0]['subject']);
|
|
$this->assertStringContainsString('Once — upon a “time”.', $mails[0]['body']);
|
|
}
|
|
|
|
public function testVisitorsCannotPostOrOverwrite(): void {
|
|
$token = $this->csrfToken($this->get('/publish')['body']);
|
|
$this->post('/publish', $this->story(array('action' => 'post', 'id' => '1', 'hidden' => 'on', 'editor' => 'ed',
|
|
'comments' => 'x', 'csrf_token' => $token, 'g-recaptcha-response' => 'pass')));
|
|
$tables = $this->tables();
|
|
$this->assertSame('Live', $tables['xxx'][0]['title']);
|
|
$this->assertCount(1, $tables['xxx']);
|
|
$this->assertCount(1, $tables['queue']);
|
|
$this->assertSame(array('original author', 0, ''), array($tables['queue'][0]['editor'], $tables['queue'][0]['hidden'], $tables['queue'][0]['comments']));
|
|
}
|
|
|
|
public function testAPostWithoutTheTokenOnlyGetsAPreview(): void {
|
|
$this->get('/publish');
|
|
$page = $this->post('/publish', $this->story(array('action' => 'submit', 'csrf_token' => 'wrong', 'g-recaptcha-response' => 'pass')));
|
|
$this->assertStringContainsString('Your session has expired. Please check your story, then send it again.', $page['body']);
|
|
$this->assertSame(array(), $this->queries('/^INSERT/'));
|
|
$this->assertSame(array(), $this->mails());
|
|
}
|
|
|
|
public function testAFailedCaptchaStopsTheStory(): void {
|
|
$token = $this->csrfToken($this->get('/publish')['body']);
|
|
$page = $this->post('/publish', $this->story(array('action' => 'submit', 'csrf_token' => $token, 'g-recaptcha-response' => 'fail')));
|
|
$this->assertStringContainsString('Please complete the captcha.', $page['body']);
|
|
$this->assertStringContainsString('g-recaptcha', $page['body']);
|
|
$this->assertSame(array(), $this->queries('/^INSERT/'));
|
|
}
|
|
|
|
public function testMissingFieldsAreShown(): void {
|
|
$token = $this->csrfToken($this->get('/publish')['body']);
|
|
$page = $this->post('/publish', array('action' => 'submit', 'csrf_token' => $token, 'g-recaptcha-response' => 'pass', 'story' => '<p>x</p>'));
|
|
$this->assertStringContainsString('<li>You have not submitted an author.</li>', $page['body']);
|
|
$this->assertStringContainsString('<label class="red" for="title">', $page['body']);
|
|
$this->assertSame(array(), $this->queries('/^INSERT/'));
|
|
}
|
|
|
|
public function testFieldsAreEscapedInTheForm(): void {
|
|
$token = $this->csrfToken($this->get('/publish')['body']);
|
|
$page = $this->post('/publish', $this->story(array('action' => 'preview', 'csrf_token' => $token, 'g-recaptcha-response' => 'pass',
|
|
'title' => '"><script>alert(1)</script>')));
|
|
$this->assertStringNotContainsString('<script>alert(1)</script>', $page['body']);
|
|
$this->assertStringContainsString('value=""><script>alert(1)</script>"', $page['body']);
|
|
}
|
|
}
|