Security update for Core, with self-updated composer
[yaffs-website] / web / core / modules / system / tests / src / Functional / Entity / EntityReferenceSelection / EntityReferenceSelectionAccessTest.php
1 <?php
2
3 namespace Drupal\Tests\system\Functional\Entity\EntityReferenceSelection;
4
5 use Drupal\comment\Tests\CommentTestTrait;
6 use Drupal\Component\Utility\Html;
7 use Drupal\Core\Language\LanguageInterface;
8 use Drupal\comment\CommentInterface;
9 use Drupal\node\Entity\Node;
10 use Drupal\Tests\BrowserTestBase;
11 use Drupal\node\NodeInterface;
12 use Drupal\user\Entity\User;
13 use Drupal\comment\Entity\Comment;
14
15 /**
16  * Tests for the base handlers provided by Entity Reference.
17  *
18  * @group entity_reference
19  */
20 class EntityReferenceSelectionAccessTest extends BrowserTestBase {
21
22   use CommentTestTrait;
23
24   /**
25    * Modules to enable.
26    *
27    * @var array
28    */
29   public static $modules = ['node', 'comment'];
30
31   protected function setUp() {
32     parent::setUp();
33
34     // Create an Article node type.
35     $this->drupalCreateContentType(['type' => 'article', 'name' => 'Article']);
36   }
37
38   /**
39    * Checks that a selection plugin returns the expected results.
40    *
41    * @param array $selection_options
42    *   An array of options as required by entity reference selection plugins.
43    * @param array $tests
44    *   An array of tests to run.
45    * @param string $handler_name
46    *   The name of the entity type selection handler being tested.
47    */
48   protected function assertReferenceable(array $selection_options, $tests, $handler_name) {
49     $handler = \Drupal::service('plugin.manager.entity_reference_selection')->getInstance($selection_options);
50
51     foreach ($tests as $test) {
52       foreach ($test['arguments'] as $arguments) {
53         $result = call_user_func_array([$handler, 'getReferenceableEntities'], $arguments);
54         $this->assertEqual($result, $test['result'], format_string('Valid result set returned by @handler.', ['@handler' => $handler_name]));
55
56         $result = call_user_func_array([$handler, 'countReferenceableEntities'], $arguments);
57         if (!empty($test['result'])) {
58           $bundle = key($test['result']);
59           $count = count($test['result'][$bundle]);
60         }
61         else {
62           $count = 0;
63         }
64
65         $this->assertEqual($result, $count, format_string('Valid count returned by @handler.', ['@handler' => $handler_name]));
66       }
67     }
68   }
69
70   /**
71    * Test the node-specific overrides of the entity handler.
72    */
73   public function testNodeHandler() {
74     $selection_options = [
75       'target_type' => 'node',
76       'handler' => 'default',
77       'target_bundles' => NULL,
78     ];
79
80     // Build a set of test data.
81     // Titles contain HTML-special characters to test escaping.
82     $node_values = [
83       'published1' => [
84         'type' => 'article',
85         'status' => NodeInterface::PUBLISHED,
86         'title' => 'Node published1 (<&>)',
87         'uid' => 1,
88       ],
89       'published2' => [
90         'type' => 'article',
91         'status' => NodeInterface::PUBLISHED,
92         'title' => 'Node published2 (<&>)',
93         'uid' => 1,
94       ],
95       'unpublished' => [
96         'type' => 'article',
97         'status' => NodeInterface::NOT_PUBLISHED,
98         'title' => 'Node unpublished (<&>)',
99         'uid' => 1,
100       ],
101     ];
102
103     $nodes = [];
104     $node_labels = [];
105     foreach ($node_values as $key => $values) {
106       $node = Node::create($values);
107       $node->save();
108       $nodes[$key] = $node;
109       $node_labels[$key] = Html::escape($node->label());
110     }
111
112     // Test as a non-admin.
113     $normal_user = $this->drupalCreateUser(['access content']);
114     \Drupal::currentUser()->setAccount($normal_user);
115     $referenceable_tests = [
116       [
117         'arguments' => [
118           [NULL, 'CONTAINS'],
119         ],
120         'result' => [
121           'article' => [
122             $nodes['published1']->id() => $node_labels['published1'],
123             $nodes['published2']->id() => $node_labels['published2'],
124           ],
125         ],
126       ],
127       [
128         'arguments' => [
129           ['published1', 'CONTAINS'],
130           ['Published1', 'CONTAINS'],
131         ],
132         'result' => [
133           'article' => [
134             $nodes['published1']->id() => $node_labels['published1'],
135           ],
136         ],
137       ],
138       [
139         'arguments' => [
140           ['published2', 'CONTAINS'],
141           ['Published2', 'CONTAINS'],
142         ],
143         'result' => [
144           'article' => [
145             $nodes['published2']->id() => $node_labels['published2'],
146           ],
147         ],
148       ],
149       [
150         'arguments' => [
151           ['invalid node', 'CONTAINS'],
152         ],
153         'result' => [],
154       ],
155       [
156         'arguments' => [
157           ['Node unpublished', 'CONTAINS'],
158         ],
159         'result' => [],
160       ],
161     ];
162     $this->assertReferenceable($selection_options, $referenceable_tests, 'Node handler');
163
164     // Test as an admin.
165     $admin_user = $this->drupalCreateUser(['access content', 'bypass node access']);
166     \Drupal::currentUser()->setAccount($admin_user);
167     $referenceable_tests = [
168       [
169         'arguments' => [
170           [NULL, 'CONTAINS'],
171         ],
172         'result' => [
173           'article' => [
174             $nodes['published1']->id() => $node_labels['published1'],
175             $nodes['published2']->id() => $node_labels['published2'],
176             $nodes['unpublished']->id() => $node_labels['unpublished'],
177           ],
178         ],
179       ],
180       [
181         'arguments' => [
182           ['Node unpublished', 'CONTAINS'],
183         ],
184         'result' => [
185           'article' => [
186             $nodes['unpublished']->id() => $node_labels['unpublished'],
187           ],
188         ],
189       ],
190     ];
191     $this->assertReferenceable($selection_options, $referenceable_tests, 'Node handler (admin)');
192   }
193
194   /**
195    * Test the user-specific overrides of the entity handler.
196    */
197   public function testUserHandler() {
198     $selection_options = [
199       'target_type' => 'user',
200       'handler' => 'default',
201       'target_bundles' => NULL,
202       'include_anonymous' => TRUE,
203     ];
204
205     // Build a set of test data.
206     $user_values = [
207       'anonymous' => User::load(0),
208       'admin' => User::load(1),
209       'non_admin' => [
210         'name' => 'non_admin <&>',
211         'mail' => 'non_admin@example.com',
212         'roles' => [],
213         'pass' => user_password(),
214         'status' => 1,
215       ],
216       'blocked' => [
217         'name' => 'blocked <&>',
218         'mail' => 'blocked@example.com',
219         'roles' => [],
220         'pass' => user_password(),
221         'status' => 0,
222       ],
223     ];
224
225     $user_values['anonymous']->name = $this->config('user.settings')->get('anonymous');
226     $users = [];
227
228     $user_labels = [];
229     foreach ($user_values as $key => $values) {
230       if (is_array($values)) {
231         $account = User::create($values);
232         $account->save();
233       }
234       else {
235         $account = $values;
236       }
237       $users[$key] = $account;
238       $user_labels[$key] = Html::escape($account->getUsername());
239     }
240
241     // Test as a non-admin.
242     \Drupal::currentUser()->setAccount($users['non_admin']);
243     $referenceable_tests = [
244       [
245         'arguments' => [
246           [NULL, 'CONTAINS'],
247         ],
248         'result' => [
249           'user' => [
250             $users['admin']->id() => $user_labels['admin'],
251             $users['non_admin']->id() => $user_labels['non_admin'],
252           ],
253         ],
254       ],
255       [
256         'arguments' => [
257           ['non_admin', 'CONTAINS'],
258           ['NON_ADMIN', 'CONTAINS'],
259         ],
260         'result' => [
261           'user' => [
262             $users['non_admin']->id() => $user_labels['non_admin'],
263           ],
264         ],
265       ],
266       [
267         'arguments' => [
268           ['invalid user', 'CONTAINS'],
269         ],
270         'result' => [],
271       ],
272       [
273         'arguments' => [
274           ['blocked', 'CONTAINS'],
275         ],
276         'result' => [],
277       ],
278     ];
279     $this->assertReferenceable($selection_options, $referenceable_tests, 'User handler');
280
281     \Drupal::currentUser()->setAccount($users['admin']);
282     $referenceable_tests = [
283       [
284         'arguments' => [
285           [NULL, 'CONTAINS'],
286         ],
287         'result' => [
288           'user' => [
289             $users['anonymous']->id() => $user_labels['anonymous'],
290             $users['admin']->id() => $user_labels['admin'],
291             $users['non_admin']->id() => $user_labels['non_admin'],
292             $users['blocked']->id() => $user_labels['blocked'],
293           ],
294         ],
295       ],
296       [
297         'arguments' => [
298           ['blocked', 'CONTAINS'],
299         ],
300         'result' => [
301           'user' => [
302             $users['blocked']->id() => $user_labels['blocked'],
303           ],
304         ],
305       ],
306       [
307         'arguments' => [
308           ['Anonymous', 'CONTAINS'],
309           ['anonymous', 'CONTAINS'],
310         ],
311         'result' => [
312           'user' => [
313             $users['anonymous']->id() => $user_labels['anonymous'],
314           ],
315         ],
316       ],
317     ];
318     $this->assertReferenceable($selection_options, $referenceable_tests, 'User handler (admin)');
319
320     // Test the 'include_anonymous' option.
321     $selection_options['include_anonymous'] = FALSE;
322     $referenceable_tests = [
323       [
324         'arguments' => [
325           ['Anonymous', 'CONTAINS'],
326           ['anonymous', 'CONTAINS'],
327         ],
328         'result' => [],
329       ],
330     ];
331     $this->assertReferenceable($selection_options, $referenceable_tests, 'User handler (does not include anonymous)');
332
333     // Check that the Anonymous user is not included in the results when no
334     // label matching is done, for example when using the 'options_select'
335     // widget.
336     $referenceable_tests = [
337       [
338         'arguments' => [
339           [NULL],
340         ],
341         'result' => [
342           'user' => [
343             $users['admin']->id() => $user_labels['admin'],
344             $users['non_admin']->id() => $user_labels['non_admin'],
345             $users['blocked']->id() => $user_labels['blocked'],
346           ],
347         ],
348       ],
349     ];
350     $this->assertReferenceable($selection_options, $referenceable_tests, 'User handler (does not include anonymous)');
351   }
352
353   /**
354    * Test the comment-specific overrides of the entity handler.
355    */
356   public function testCommentHandler() {
357     $selection_options = [
358       'target_type' => 'comment',
359       'handler' => 'default',
360       'target_bundles' => NULL,
361     ];
362
363     // Build a set of test data.
364     $node_values = [
365       'published' => [
366         'type' => 'article',
367         'status' => 1,
368         'title' => 'Node published',
369         'uid' => 1,
370       ],
371       'unpublished' => [
372         'type' => 'article',
373         'status' => 0,
374         'title' => 'Node unpublished',
375         'uid' => 1,
376       ],
377     ];
378     $nodes = [];
379     foreach ($node_values as $key => $values) {
380       $node = Node::create($values);
381       $node->save();
382       $nodes[$key] = $node;
383     }
384
385     // Create comment field on article.
386     $this->addDefaultCommentField('node', 'article');
387
388     $comment_values = [
389       'published_published' => [
390         'entity_id' => $nodes['published']->id(),
391         'entity_type' => 'node',
392         'field_name' => 'comment',
393         'uid' => 1,
394         'cid' => NULL,
395         'pid' => 0,
396         'status' => CommentInterface::PUBLISHED,
397         'subject' => 'Comment Published <&>',
398         'language' => LanguageInterface::LANGCODE_NOT_SPECIFIED,
399       ],
400       'published_unpublished' => [
401         'entity_id' => $nodes['published']->id(),
402         'entity_type' => 'node',
403         'field_name' => 'comment',
404         'uid' => 1,
405         'cid' => NULL,
406         'pid' => 0,
407         'status' => CommentInterface::NOT_PUBLISHED,
408         'subject' => 'Comment Unpublished <&>',
409         'language' => LanguageInterface::LANGCODE_NOT_SPECIFIED,
410       ],
411       'unpublished_published' => [
412         'entity_id' => $nodes['unpublished']->id(),
413         'entity_type' => 'node',
414         'field_name' => 'comment',
415         'uid' => 1,
416         'cid' => NULL,
417         'pid' => 0,
418         'status' => CommentInterface::NOT_PUBLISHED,
419         'subject' => 'Comment Published on Unpublished node <&>',
420         'language' => LanguageInterface::LANGCODE_NOT_SPECIFIED,
421       ],
422     ];
423
424     $comments = [];
425     $comment_labels = [];
426     foreach ($comment_values as $key => $values) {
427       $comment = Comment::create($values);
428       $comment->save();
429       $comments[$key] = $comment;
430       $comment_labels[$key] = Html::escape($comment->label());
431     }
432
433     // Test as a non-admin.
434     $normal_user = $this->drupalCreateUser(['access content', 'access comments']);
435     \Drupal::currentUser()->setAccount($normal_user);
436     $referenceable_tests = [
437       [
438         'arguments' => [
439           [NULL, 'CONTAINS'],
440         ],
441         'result' => [
442           'comment' => [
443             $comments['published_published']->cid->value => $comment_labels['published_published'],
444           ],
445         ],
446       ],
447       [
448         'arguments' => [
449           ['Published', 'CONTAINS'],
450         ],
451         'result' => [
452           'comment' => [
453             $comments['published_published']->cid->value => $comment_labels['published_published'],
454           ],
455         ],
456       ],
457       [
458         'arguments' => [
459           ['invalid comment', 'CONTAINS'],
460         ],
461         'result' => [],
462       ],
463       [
464         'arguments' => [
465           ['Comment Unpublished', 'CONTAINS'],
466         ],
467         'result' => [],
468       ],
469     ];
470     $this->assertReferenceable($selection_options, $referenceable_tests, 'Comment handler');
471
472     // Test as a comment admin.
473     $admin_user = $this->drupalCreateUser(['access content', 'access comments', 'administer comments']);
474     \Drupal::currentUser()->setAccount($admin_user);
475     $referenceable_tests = [
476       [
477         'arguments' => [
478           [NULL, 'CONTAINS'],
479         ],
480         'result' => [
481           'comment' => [
482             $comments['published_published']->cid->value => $comment_labels['published_published'],
483             $comments['published_unpublished']->cid->value => $comment_labels['published_unpublished'],
484           ],
485         ],
486       ],
487     ];
488     $this->assertReferenceable($selection_options, $referenceable_tests, 'Comment handler (comment admin)');
489
490     // Test as a node and comment admin.
491     $admin_user = $this->drupalCreateUser(['access content', 'access comments', 'administer comments', 'bypass node access']);
492     \Drupal::currentUser()->setAccount($admin_user);
493     $referenceable_tests = [
494       [
495         'arguments' => [
496           [NULL, 'CONTAINS'],
497         ],
498         'result' => [
499           'comment' => [
500             $comments['published_published']->cid->value => $comment_labels['published_published'],
501             $comments['published_unpublished']->cid->value => $comment_labels['published_unpublished'],
502             $comments['unpublished_published']->cid->value => $comment_labels['unpublished_published'],
503           ],
504         ],
505       ],
506     ];
507     $this->assertReferenceable($selection_options, $referenceable_tests, 'Comment handler (comment + node admin)');
508   }
509
510 }