View source
<?php
namespace Drupal\Tests\quickedit\Functional;
use Drupal\Component\Serialization\Json;
use Drupal\Core\EventSubscriber\MainContentViewSubscriber;
use Drupal\Tests\BrowserTestBase;
use GuzzleHttp\RequestOptions;
class QuickEditEndPointAccessTest extends BrowserTestBase {
protected static $modules = [
'quickedit',
'node',
];
protected $defaultTheme = 'stark';
protected function setUp() : void {
parent::setUp();
$this
->drupalCreateContentType([
'type' => 'article',
'name' => 'Article',
]);
}
public function testEndPointAccess() {
$url = $this
->buildUrl('/quickedit/attachments');
$post = [
'editors[0]' => 'form',
];
$this
->assertAccessIsBlocked($url, $post);
$node = $this
->createNode([
'type' => 'article',
]);
$url = $this
->buildUrl('quickedit/form/node/' . $node
->id() . '/body/en/full');
$post = [
'nocssjs' => 'true',
];
$this
->assertAccessIsBlocked($url, $post);
$edit = [];
$edit['form_id'] = 'quickedit_field_form';
$edit['form_token'] = 'xIOzMjuc-PULKsRn_KxFn7xzNk5Bx7XKXLfQfw1qOnA';
$edit['form_build_id'] = 'form-kVmovBpyX-SJfTT5kY0pjTV35TV-znor--a64dEnMR8';
$edit['body[0][summary]'] = '';
$edit['body[0][value]'] = '<p>Malicious content.</p>';
$edit['body[0][format]'] = 'filtered_html';
$edit['op'] = 'Save';
$this
->assertAccessIsBlocked($url, $edit);
$post = [
'nocssjs' => 'true',
];
$url = $this
->buildUrl('quickedit/entity/node/' . $node
->id());
$this
->assertAccessIsBlocked($url, $post);
}
protected function assertAccessIsBlocked(string $url, array $body) : void {
$client = $this
->getHttpClient();
$message = [
'message' => "The 'access in-place editing' permission is required.",
];
$response = $client
->post($url, [
RequestOptions::BODY => http_build_query($body),
RequestOptions::QUERY => [
MainContentViewSubscriber::WRAPPER_FORMAT => 'drupal_ajax',
],
RequestOptions::COOKIES => $this
->getSessionCookies(),
RequestOptions::HEADERS => [
'Accept' => 'application/json',
'Content-Type' => 'application/x-www-form-urlencoded',
],
RequestOptions::HTTP_ERRORS => FALSE,
]);
$this
->assertEquals(403, $response
->getStatusCode());
$response_message = Json::decode($response
->getBody());
$this
->assertSame($message, $response_message);
}
}