session.test 12.2 KB
Newer Older
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
<?php
// $Id$

/**
 * @file
 * Provides SimpleTests for core session handling functionality.
 */

class SessionTestCase extends DrupalWebTestCase {
  function getInfo() {
    return array(
      'name' => t('Session tests'),
      'description' => t('Drupal session handling tests.'),
      'group' => t('Session')
    );
  }

  function setUp() {
    parent::setUp('session_test');
  }
21

22
  /**
23
   * Tests for drupal_save_session() and drupal_session_regenerate().
24
   */
25
  function testSessionSaveRegenerate() {
26
    $this->assertFalse(drupal_save_session(), t('drupal_save_session() correctly returns FALSE (inside of testing framework) when initially called with no arguments.'), t('Session'));
27
28
29
30
    $this->assertFalse(drupal_save_session(FALSE), t('drupal_save_session() correctly returns FALSE when called with FALSE.'), t('Session'));
    $this->assertFalse(drupal_save_session(), t('drupal_save_session() correctly returns FALSE when saving has been disabled.'), t('Session'));
    $this->assertTrue(drupal_save_session(TRUE), t('drupal_save_session() correctly returns TRUE when called with TRUE.'), t('Session'));
    $this->assertTrue(drupal_save_session(), t('drupal_save_session() correctly returns TRUE when saving has been enabled.'), t('Session'));
31
32
33
34
35
36
37

    // Test session hardening code from SA-2008-044.
    $user = $this->drupalCreateUser(array('access content'));
    // Enable sessions.
    $this->sessionReset($user->uid);
    // Make sure the session cookie is set as HttpOnly.
    $this->drupalLogin($user);
38
    $this->assertTrue(preg_match('/HttpOnly/i', $this->drupalGetHeader('Set-Cookie', TRUE)), t('Session cookie is set as HttpOnly.'));
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
    $this->drupalLogout();
    // Verify that the session is regenerated if a module calls exit
    // in hook_user_login().
    user_save($user, array('name' => 'session_test_user'));
    $user->name = 'session_test_user';
    $this->drupalGet('session-test/id');
    $matches = array();
    preg_match('/\s*session_id:(.*)\n/', $this->drupalGetContent(), $matches);
    $this->assertTrue(!empty($matches[1]) , t('Found session ID before logging in.'));
    $original_session = $matches[1];
    // We cannot use $this->drupalLogin($user); because we exit in
    // session_test_user_login() which breaks a normal assertion.
    $edit = array(
      'name' => $user->name,
      'pass' => $user->pass_raw
    );
    $this->drupalPost('user', $edit, t('Log in'));
    $this->drupalGet('node');
    $pass = $this->assertText($user->name, t('Found name: %name', array('%name' => $user->name)), t('User login'));
    $this->_logged_in = $pass;

    $this->drupalGet('session-test/id');
    $matches = array();
    preg_match('/\s*session_id:(.*)\n/', $this->drupalGetContent(), $matches);
    $this->assertTrue(!empty($matches[1]) , t('Found session ID after logging in.'));
    $this->assertTrue($matches[1] != $original_session, t('Session ID changed after login.'));
65
66
67
68
  }

  /**
   * Test data persistence via the session_test module callbacks. Also tests
69
   * drupal_session_count() since session data is already generated here.
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
   */
  function testDataPersistence() {
    $user = $this->drupalCreateUser(array('access content'));
    // Enable sessions.
    $this->sessionReset($user->uid);

    $this->drupalLogin($user);
    $this->session_count_authenticated = $this->session_count++;

    $value_1 = $this->randomName();
    $this->drupalGet('session-test/set/' . $value_1);
    $this->assertText($value_1, t('The session value was stored.'), t('Session'));
    $this->drupalGet('session-test/get');
    $this->assertText($value_1, t('Session correctly returned the stored data for an authenticated user.'), t('Session'));

85
    // Attempt to write over val_1. If drupal_save_session(FALSE) is working.
86
87
88
89
90
    // properly, val_1 will still be set.
    $value_2 = $this->randomName();
    $this->drupalGet('session-test/no-set/' . $value_2);
    $this->assertText($value_2, t('The session value was correctly passed to session-test/no-set.'), t('Session'));
    $this->drupalGet('session-test/get');
91
    $this->assertText($value_1, t('Session data is not saved for drupal_save_session(FALSE).'), t('Session'));
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115

    // Switch browser cookie to anonymous user, then back to user 1.
    $this->sessionReset();
    $this->sessionReset($user->uid);
    $this->assertText($value_1, t('Session data persists through browser close.'), t('Session'));

    // Logout the user and make sure the stored value no longer persists.
    $this->drupalLogout();
    $this->sessionReset();
    $this->drupalGet('session-test/get');
    // Session count should go up since we're accessing anonymously now.
    $this->session_count_anonymous = $this->session_count++;
    $this->assertNoText($value_1, t("After logout, previous user's session data is not available."), t('Session'));

    $value_3 = $this->randomName();
    $this->drupalGet('session-test/set/' . $value_3);
    $this->assertText($value_3, t('Session data stored for anonymous user.'), t('Session'));
    $this->drupalGet('session-test/get');
    $this->assertText($value_3, t('Session correctly returned the stored data for an anonymous user.'), t('Session'));

    $value_4 = $this->randomName();
    $this->drupalGet('session-test/no-set/' . $value_4);
    $this->assertText($value_4, t('The session value was correctly passed to session-test/no-set.'), t('Session'));
    $this->drupalGet('session-test/get');
116
    $this->assertText($value_3, t('Session data is not saved for drupal_save_session(FALSE).'), t('Session'));
117
118
119
120
121
122
123
124
125
126
127
128
129
130

    // Logout and get first user back in. Sessions shouldn't persist through
    // logout, so the data won't be on the page.
    $this->drupalLogin($user);
    $this->sessionReset($user->uid);
    $this->drupalGet('session-test/get');
    $this->assertNoText($value_1, t('Session has persisted for an authenticated user after logging out and then back in.'), t('Session'));

    // Logout and create another user.
    $user2 = $this->drupalCreateUser(array('access content'));
    $this->sessionReset($user2->uid);
    $this->drupalLogin($user2);
    $this->session_count_authenticated = $this->session_count++;

131
    // Perform drupal_session_count tests here in order to use the session data already generated.
132
    // Test absolute count.
133
134
    $anonymous = drupal_session_count(0, TRUE);
    $authenticated = drupal_session_count(0, FALSE);
135
136
137
138
139
140
141
142
143
    $this->assertEqual($anonymous + $authenticated, $this->session_count, t('Correctly counted @count total sessions.', array('@count' => $this->session_count)), t('Session'));

    // Test anonymous count.
    $this->assertEqual($anonymous, $this->session_count_anonymous, t('Correctly counted @count anonymous sessions.', array('@count' => $anonymous)), t('Session'));

    // Test authenticated count.
    $this->assertEqual($authenticated, $this->session_count_authenticated, t('Correctly counted @count authenticated sessions.', array('@count' => $authenticated)), t('Session'));

    // Should return 0 sessions from 1 second from now.
144
    $this->assertEqual(drupal_session_count(time() + 1), 0, t('Correctly returned 0 sessions newer than the current time.'), t('Session'));
145
146
147

  }

148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
  /**
   * Test that empty anonymous sessions are destroyed.
   */
  function testEmptyAnonymousSession() {
    // With caching disabled, a session is always started.
    $this->drupalGet('');
    $this->assertSessionCookie(FALSE);
    $this->assertSessionStarted(TRUE);
    $this->assertSessionEmpty(TRUE);

    variable_set('cache', CACHE_NORMAL);

    // During this request the session is destroyed in drupal_page_footer(),
    // and the session cookie is unset.
    $this->drupalGet('');
    $this->assertSessionCookie(TRUE);
    $this->assertSessionStarted(TRUE);
    $this->assertSessionEmpty(TRUE);
    $this->assertFalse($this->drupalGetHeader('ETag'), t('Page was not cached.'));
    // When PHP deletes a cookie, it sends "Set-Cookie: cookiename=deleted;
    // expires=..."
    $this->assertTrue(preg_match('/SESS\w+=deleted/', $this->drupalGetHeader('Set-Cookie')), t('Session cookie was deleted.'));

    // Verify that the session cookie was actually deleted.
    $this->drupalGet('');
    $this->assertSessionCookie(FALSE);
    $this->assertSessionStarted(FALSE);
    $this->assertFalse($this->drupalGetHeader('Set-Cookie'), t('New session was not started.'));

    // Start a new session by setting a message.
    $this->drupalGet('session-test/set-message');
    $this->assertSessionCookie(FALSE);
    $this->assertSessionStarted(FALSE);
    $this->assertTrue($this->drupalGetHeader('Set-Cookie'), t('New session was started.'));

    // Display the message.
    $this->drupalGet('');
    $this->assertSessionCookie(TRUE);
    $this->assertSessionStarted(TRUE);
    $this->assertSessionEmpty(FALSE);
    $this->assertFalse($this->drupalGetHeader('ETag'), t('Page was not cached.'));
    $this->assertText(t('This is a dummy message.'), t('Message was displayed.'));

    // During this request the session is destroyed in _drupal_bootstrap(),
    // and the session cookie is unset.
    $this->drupalGet('');
    $this->assertSessionCookie(TRUE);
    $this->assertSessionStarted(TRUE);
    $this->assertSessionEmpty(TRUE);
    $this->assertTrue($this->drupalGetHeader('ETag'), t('Page was cached.'));
    $this->assertNoText(t('This is a dummy message.'), t('Message was not cached.'));
    $this->assertTrue(preg_match('/SESS\w+=deleted/', $this->drupalGetHeader('Set-Cookie')), t('Session cookie was deleted.'));

    // Verify that session was destroyed.
    $this->drupalGet('');
    $this->assertSessionCookie(FALSE);
    $this->assertSessionStarted(FALSE);
    $this->assertTrue($this->drupalGetHeader('ETag'), t('Page was cached.'));
    $this->assertFalse($this->drupalGetHeader('Set-Cookie'), t('New session was not started.'));

    // Verify that modifying $_SESSION without having started a session
    // generates a watchdog message, and that no messages have been generated
    // so far.
    $this->assertEqual($this->getWarningCount(), 0, t('No watchdog messages have been generated'));
    $this->drupalGet('/session-test/set-not-started');
    $this->assertSessionCookie(FALSE);
    $this->assertSessionStarted(FALSE);
    $this->assertEqual($this->getWarningCount(), 1, t('1 watchdog messages has been generated'));
  }

  /**
   * Count watchdog messages about modifying $_SESSION without having started a
   * session.
   */
  function getWarningCount() {
    return db_select('watchdog')
      ->condition('type', 'session')
      ->condition('message', '$_SESSION is non-empty yet no code has called drupal_session_start().')
      ->countQuery()
      ->execute()
      ->fetchField();
  }

231
232
233
234
235
236
237
238
239
240
  /**
   * Reset the cookie file so that it refers to the specified user.
   *
   * @param $uid User id to set as the active session.
   */
  function sessionReset($uid = 0) {
    // Close the internal browser.
    $this->curlClose();

    // Change cookie file for user.
241
242
243
    $this->cookieFile = file_directory_temp() . '/cookie.' . $uid . '.txt';
    $this->additionalCurlOptions[CURLOPT_COOKIEFILE] = $this->cookieFile;
    $this->additionalCurlOptions[CURLOPT_COOKIESESSION] = TRUE;
244
245
246
    $this->drupalGet('session-test/get');
    $this->assertResponse(200, t('Session test module is correctly enabled.'), t('Session'));
  }
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282

  /**
   * Assert whether the SimpleTest browser sent a session cookie.
   */
  function assertSessionCookie($sent) {
    if ($sent) {
      $this->assertIdentical($this->drupalGetHeader('X-Session-Cookie'), '1', t('Session cookie was sent.'));
    }
    else {
      $this->assertIdentical($this->drupalGetHeader('X-Session-Cookie'), '0', t('Session cookie was not sent.'));
    }
  }

  /**
   * Assert whether session was started during the bootstrap process.
   */
  function assertSessionStarted($started) {
    if ($started) {
      $this->assertIdentical($this->drupalGetHeader('X-Session-Started'), '1', t('Session was started.'));
    }
    else {
      $this->assertIdentical($this->drupalGetHeader('X-Session-Started'), '0', t('Session was not started.'));
    }
  }

  /**
   * Assert whether $_SESSION is empty at the beginning of the request.
   */
  function assertSessionEmpty($empty) {
    if ($empty) {
      $this->assertIdentical($this->drupalGetHeader('X-Session-Empty'), '1', t('Session was empty.'));
    }
    else {
      $this->assertIdentical($this->drupalGetHeader('X-Session-Empty'), '0', t('Session was not empty.'));
    }
  }
283
}