Commit bab40b22 authored by Alexander Varwijk's avatar Alexander Varwijk Committed by Léo Prada
Browse files

Issue #3010747 by Nixou, Kingdutch, yarik.lutsiuk: r4032login should perform...

Issue #3010747 by Nixou, Kingdutch, yarik.lutsiuk: r4032login should perform access check for /user/login as anonymous user
parent 8fdd0d3a
Loading
Loading
Loading
Loading
+15 −2
Changes for r4032login.module: 15 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -6,6 +6,8 @@
 */

use Drupal\Core\Form\FormStateInterface;
use Drupal\Core\Url;
use Drupal\user\Entity\User;

/**
 * Implements hook_form_FORM_ID_alter().
@@ -154,8 +156,19 @@ function r4032login_form_system_site_information_settings_validate($form, FormSt
      $r4032loginUserLoginPath = str_replace($renameAdminPathsSettings['user_path_value'], 'user', $r4032loginUserLoginPath);
    }

    if (!$path_validator->isValid($r4032loginUserLoginPath)) {
      $form_state->setErrorByName('r4032login_user_login_path', t("The user login form path '%path' is either invalid or you do not have access to it.", [
    // Check whether the anonymous user can access the entered path.
    // Url::fromUserInput checks for a valid internal path under the hood.
    $valid_path = FALSE;
    try {
      $url = Url::fromUserInput($r4032loginUserLoginPath);
      $valid_path = $url && $url->access(User::getAnonymousUser());
    }
    catch (\InvalidArgumentException $e) {
      // If an invalid URL was entered then we're done.
    }

    if (!$valid_path) {
      $form_state->setErrorByName('r4032login_user_login_path', t("The user login form path '%path' is either invalid or a logged out user does not have access to it.", [
        '%path' => $form_state->getValue('r4032login_user_login_path'),
      ]));
    }
+80 −0
Changes for tests/src/Functional/SettingsUpdateTest.php: 80 added lines, 0 removed lines.
Original line number Diff line number Diff line
<?php

namespace Drupal\Tests\r4032login\Functional;

use Drupal\Tests\BrowserTestBase;

/**
 * Test update of settings from admin/config/system/site-information.
 *
 * @group r4032login
 */
class SettingsUpdateTest extends BrowserTestBase {

  /**
   * {@inheritdoc}
   */
  protected $defaultTheme = 'stark';

  /**
   * {@inheritdoc}
   */
  protected static $modules = ['r4032login'];

  /**
   * Test update of settings.
   *
   * @param array $permissions
   *   The permissions for the user to test against.
   * @param bool $admin
   *   Either or not the user to test against is an admin.
   *
   * @dataProvider settingsUpdateDataProvider
   *
   * @throws \Behat\Mink\Exception\ExpectationException
   * @throws \Drupal\Core\Entity\EntityStorageException
   */
  public function testSettingsUpdate(array $permissions, $admin) {
    $webUser = $this->drupalCreateUser($permissions, NULL, $admin);

    $this->drupalLogin($webUser);

    $edit = [
      'r4032login_redirect_to_destination' => FALSE,
      'r4032login_display_denied_message' => FALSE,
      'r4032login_access_denied_message' => 'Access denied',
      'r4032login_access_denied_message_type' => 'status',
      'r4032login_redirect_authenticated_users_to' => 'https://www.drupal.org',
      'r4032login_user_login_path' => '/user/login',
      'r4032login_default_redirect_code' => 302,
      'r4032login_destination_parameter_override' => 'test',
      'r4032login_match_noredirect_pages' => '/admin/config',
    ];
    $this->drupalPostForm('admin/config/system/site-information', $edit, 'Save configuration');

    $this->assertSession()->pageTextContains('The configuration options have been saved.');

    $config = $this->config('r4032login.settings');
    foreach ($edit as $key => $value) {
      $key = str_replace('r4032login_', '', $key);
      $this->assertEqual($config->get($key), $value);
    }
  }

  /**
   * Data provider for testSettingsUpdate.
   */
  public function settingsUpdateDataProvider() {
    return [
      [
        [],
        TRUE,
      ],
      [
        ['administer site configuration', 'link to any page'],
        FALSE,
      ],
    ];
  }

}