tim
be814a3ba5
Same-site redirects are now relative paths, and a saved page on another site is ignored. The HTTP to HTTPS redirect takes its host from the new SITE_URL setting, and without it the pages refuse plain HTTP.
68 lines
2.8 KiB
PHP
68 lines
2.8 KiB
PHP
<?php
|
|
namespace Xxx\Tests\Pages;
|
|
|
|
use Xxx\Tests\Support\PageTestCase;
|
|
|
|
// publish/addeditor.php
|
|
class AddEditorTest extends PageTestCase {
|
|
private string $token;
|
|
|
|
protected function setUp(): void {
|
|
parent::setUp();
|
|
$this->setTables(array('editors' => array(array('username' => 'ed', 'password' => 'x', 'email' => ''))));
|
|
$this->token = $this->loginAs();
|
|
}
|
|
|
|
private function add(array $fields = array()): array {
|
|
return $this->post('/publish/addeditor', $fields + array('adduser' => '1', 'username' => 'newbie', 'password' => 'pass word',
|
|
'email' => 'new@example.org', 'csrf_token' => $this->token));
|
|
}
|
|
|
|
public function testVisitorsAreSentToTheLogin(): void {
|
|
$this->cookies = array();
|
|
$this->assertRedirect('/publish/login', $this->get('/publish/addeditor'));
|
|
$this->assertRedirect('/publish/login', $this->add(array('csrf_token' => '')));
|
|
$this->assertCount(1, $this->tables()['editors']);
|
|
}
|
|
|
|
public function testPlainHttpIsSentToHttps(): void {
|
|
$this->assertRedirect('https://site.test/publish/addeditor', $this->get('/publish/addeditor', array('X-Test-Plain' => '1')));
|
|
}
|
|
|
|
public function testTheFormHasTheToken(): void {
|
|
$this->assertSame($this->token, $this->csrfToken($this->get('/publish/addeditor')['body']));
|
|
}
|
|
|
|
public function testAnEditorIsAddedWithAPasswordHash(): void {
|
|
$answer = $this->add();
|
|
$this->assertStringContainsString('<p>Added editor newbie</p>', $answer['body']);
|
|
$row = $this->tables()['editors'][1];
|
|
$this->assertSame(array('newbie', 'new@example.org'), array($row['username'], $row['email']));
|
|
$this->assertTrue(password_verify('pass word', $row['password']));
|
|
}
|
|
|
|
public function testTheTokenIsChecked(): void {
|
|
$answer = $this->add(array('csrf_token' => 'wrong'));
|
|
$this->assertStringContainsString('Your session has expired. Please try again.', $answer['body']);
|
|
$this->assertCount(1, $this->tables()['editors']);
|
|
}
|
|
|
|
public function testAnExistingUsernameIsRefused(): void {
|
|
$answer = $this->add(array('username' => 'ed'));
|
|
$this->assertStringContainsString('An editor with that username already exists.', $answer['body']);
|
|
$this->assertSame('x', $this->tables()['editors'][0]['password']);
|
|
}
|
|
|
|
public function testAHashThatDoesNotFitIsNotKept(): void {
|
|
$this->setTables(array('editors' => array()), 40);
|
|
$answer = $this->add();
|
|
$this->assertStringContainsString('the editors.password column is too short', $answer['body']);
|
|
$this->assertSame(array(), $this->tables()['editors']);
|
|
}
|
|
|
|
public function testTheUsernameIsEscaped(): void {
|
|
$body = $this->add(array('username' => '<b>x</b>'))['body'];
|
|
$this->assertStringContainsString('Added editor <b>x</b>', $body);
|
|
}
|
|
}
|