class QuickEditEndPointAccessTest in Drupal 10

Tests accessing the Quick Edit endpoints.

@group quickedit

Hierarchy

• class \Drupal\Tests\BrowserTestBase extends \PHPUnit\Framework\TestCase uses \Drupal\Tests\PhpUnitCompatibilityTrait, \Symfony\Bridge\PhpUnit\ExpectDeprecationTrait, FunctionalTestSetupTrait, TestSetupTrait, BlockCreationTrait, ConfigTestTrait, ExtensionListTestTrait, ContentTypeCreationTrait, NodeCreationTrait, RandomGeneratorTrait, TestRequirementsTrait, PhpUnitWarnings, UiHelperTrait, UserCreationTrait, XdebugRequestTrait
  • class \Drupal\Tests\quickedit\Functional\QuickEditEndPointAccessTest

File

core/modules/quickedit/tests/src/Functional/QuickEditEndPointAccessTest.php, line 15

Namespace

Drupal\Tests\quickedit\Functional

class QuickEditEndPointAccessTest extends BrowserTestBase {

  /**
   * {@inheritdoc}
   */
  protected static $modules = [
    'quickedit',
    'node',
  ];

  /**
   * {@inheritdoc}
   */
  protected $defaultTheme = 'stark';

  /**
   * {@inheritdoc}
   */
  protected function setUp() : void {
    parent::setUp();
    $this
      ->drupalCreateContentType([
      'type' => 'article',
      'name' => 'Article',
    ]);
  }

  /**
   * Tests that Quick Edit endpoints are protected from anonymous requests.
   */
  public function testEndPointAccess() {

    // Quick Edit's JavaScript would never hit these endpoints, but we need to
    // make sure that malicious users aren't able to use any of the other
    // endpoints either.
    $url = $this
      ->buildUrl('/quickedit/attachments');
    $post = [
      'editors[0]' => 'form',
    ];
    $this
      ->assertAccessIsBlocked($url, $post);
    $node = $this
      ->createNode([
      'type' => 'article',
    ]);
    $url = $this
      ->buildUrl('quickedit/form/node/' . $node
      ->id() . '/body/en/full');
    $post = [
      'nocssjs' => 'true',
    ];
    $this
      ->assertAccessIsBlocked($url, $post);
    $edit = [];
    $edit['form_id'] = 'quickedit_field_form';
    $edit['form_token'] = 'xIOzMjuc-PULKsRn_KxFn7xzNk5Bx7XKXLfQfw1qOnA';
    $edit['form_build_id'] = 'form-kVmovBpyX-SJfTT5kY0pjTV35TV-znor--a64dEnMR8';
    $edit['body[0][summary]'] = '';
    $edit['body[0][value]'] = '<p>Malicious content.</p>';
    $edit['body[0][format]'] = 'filtered_html';
    $edit['op'] = 'Save';
    $this
      ->assertAccessIsBlocked($url, $edit);
    $post = [
      'nocssjs' => 'true',
    ];
    $url = $this
      ->buildUrl('quickedit/entity/node/' . $node
      ->id());
    $this
      ->assertAccessIsBlocked($url, $post);
  }

  /**
   * Asserts that access to the passed URL is blocked.
   *
   * @param string $url
   *   The URL to check.
   * @param array $body
   *   The payload to send with the request.
   *
   * @internal
   */
  protected function assertAccessIsBlocked(string $url, array $body) : void {
    $client = $this
      ->getHttpClient();
    $message = [
      'message' => "The 'access in-place editing' permission is required.",
    ];
    $response = $client
      ->post($url, [
      RequestOptions::BODY => http_build_query($body),
      RequestOptions::QUERY => [
        MainContentViewSubscriber::WRAPPER_FORMAT => 'drupal_ajax',
      ],
      RequestOptions::COOKIES => $this
        ->getSessionCookies(),
      RequestOptions::HEADERS => [
        'Accept' => 'application/json',
        'Content-Type' => 'application/x-www-form-urlencoded',
      ],
      RequestOptions::HTTP_ERRORS => FALSE,
    ]);
    $this
      ->assertEquals(403, $response
      ->getStatusCode());
    $response_message = Json::decode($response
      ->getBody());
    $this
      ->assertSame($message, $response_message);
  }

}