class SitesDirectoryHardeningTest in Drupal 8
Same name and namespace in other branches
- 9 core/modules/system/tests/src/Functional/System/SitesDirectoryHardeningTest.php \Drupal\Tests\system\Functional\System\SitesDirectoryHardeningTest
- 10 core/modules/system/tests/src/Functional/System/SitesDirectoryHardeningTest.php \Drupal\Tests\system\Functional\System\SitesDirectoryHardeningTest
Tests Drupal permissions hardening of /sites subdirectories.
@group system
Hierarchy
- class \Drupal\Tests\BrowserTestBase extends \PHPUnit\Framework\TestCase uses FunctionalTestSetupTrait, TestSetupTrait, AssertLegacyTrait, BlockCreationTrait, ConfigTestTrait, ContentTypeCreationTrait, NodeCreationTrait, PhpunitCompatibilityTrait, RandomGeneratorTrait, TestRequirementsTrait, UiHelperTrait, UserCreationTrait, XdebugRequestTrait
- class \Drupal\Tests\system\Functional\System\SitesDirectoryHardeningTest uses StringTranslationTrait
Expanded class hierarchy of SitesDirectoryHardeningTest
File
- core/
modules/ system/ tests/ src/ Functional/ System/ SitesDirectoryHardeningTest.php, line 15
Namespace
Drupal\Tests\system\Functional\SystemView source
class SitesDirectoryHardeningTest extends BrowserTestBase {
use StringTranslationTrait;
/**
* {@inheritdoc}
*/
protected $defaultTheme = 'stark';
/**
* Tests the default behavior to restrict directory permissions is enforced.
*
* Checks both the current sites directory and settings.php.
*/
public function testSitesDirectoryHardening() {
$site_path = $this->kernel
->getSitePath();
$settings_file = $this
->settingsFile($site_path);
// First, we check based on what the initial install has set.
$this
->assertTrue(drupal_verify_install_file($site_path, FILE_NOT_WRITABLE, 'dir'), new FormattableMarkup('Verified permissions for @file.', [
'@file' => $site_path,
]));
// We intentionally don't check for settings.local.php as that file is
// not created by Drupal.
$this
->assertTrue(drupal_verify_install_file($settings_file, FILE_EXIST | FILE_READABLE | FILE_NOT_WRITABLE), new FormattableMarkup('Verified permissions for @file.', [
'@file' => $settings_file,
]));
$this
->makeWritable($site_path);
$this
->checkSystemRequirements();
$this
->assertTrue(drupal_verify_install_file($site_path, FILE_NOT_WRITABLE, 'dir'), new FormattableMarkup('Verified permissions for @file after manual permissions change.', [
'@file' => $site_path,
]));
$this
->assertTrue(drupal_verify_install_file($settings_file, FILE_EXIST | FILE_READABLE | FILE_NOT_WRITABLE), new FormattableMarkup('Verified permissions for @file after manual permissions change.', [
'@file' => $settings_file,
]));
}
/**
* Tests writable files remain writable when directory hardening is disabled.
*/
public function testSitesDirectoryHardeningConfig() {
$site_path = $this->kernel
->getSitePath();
$settings_file = $this
->settingsFile($site_path);
// Disable permissions enforcement.
$settings = Settings::getAll();
$settings['skip_permissions_hardening'] = TRUE;
new Settings($settings);
$this
->assertTrue(Settings::get('skip_permissions_hardening'), 'Able to set skip permissions hardening to true.');
$this
->makeWritable($site_path);
// Manually trigger the requirements check.
$requirements = $this
->checkSystemRequirements();
$this
->assertEqual(REQUIREMENT_WARNING, $requirements['configuration_files']['severity'], 'Warning severity is properly set.');
$this
->assertEquals('Protection disabled', (string) $requirements['configuration_files']['value']);
$description = strip_tags(\Drupal::service('renderer')
->renderPlain($requirements['configuration_files']['description']));
$this
->assertStringContainsString('settings.php is not protected from modifications and poses a security risk.', $description);
$this
->assertStringContainsString('services.yml is not protected from modifications and poses a security risk.', $description);
// Verify that site directory and the settings.php remain writable when
// automatically enforcing file permissions is disabled.
$this
->assertDirectoryIsWritable($site_path);
$this
->assertFileIsWritable($settings_file);
// Re-enable permissions enforcement.
$settings = Settings::getAll();
$settings['skip_permissions_hardening'] = FALSE;
new Settings($settings);
// Manually trigger the requirements check.
$requirements = $this
->checkSystemRequirements();
$this
->assertEquals('Protected', (string) $requirements['configuration_files']['value']);
// Verify that site directory and the settings.php remain protected when
// automatically enforcing file permissions is enabled.
$this
->assertDirectoryNotIsWritable($site_path);
$this
->assertFileNotIsWritable($settings_file);
}
/**
* Checks system runtime requirements.
*
* @return array
* An array of system requirements.
*/
protected function checkSystemRequirements() {
module_load_install('system');
return system_requirements('runtime');
}
/**
* Makes the given path and settings file writable.
*
* @param string $site_path
* The sites directory path, such as 'sites/default'.
*/
protected function makeWritable($site_path) {
chmod($site_path, 0755);
chmod($this
->settingsFile($site_path), 0644);
}
/**
* Returns the path to settings.php
*
* @param string $site_path
* The sites subdirectory path.
*
* @return string
* The path to settings.php.
*/
protected function settingsFile($site_path) {
$settings_file = $site_path . '/settings.php';
return $settings_file;
}
}
Members
Name | Modifiers | Type | Description | Overrides |
---|---|---|---|---|
AssertHelperTrait:: |
protected static | function | Casts MarkupInterface objects into strings. | |
AssertLegacyTrait:: |
protected | function | Deprecated Scheduled for removal in Drupal 10.0.0. Use self::assertTrue() instead. | |
AssertLegacyTrait:: |
protected | function | Asserts whether an expected cache tag was present in the last response. | |
AssertLegacyTrait:: |
protected | function | Asserts that the element with the given CSS selector is not present. | |
AssertLegacyTrait:: |
protected | function | Asserts that the element with the given CSS selector is present. | |
AssertLegacyTrait:: |
protected | function | Deprecated Scheduled for removal in Drupal 10.0.0. Use self::assertEquals() instead. | |
AssertLegacyTrait:: |
protected | function | Passes if the raw text IS found escaped on the loaded page, fail otherwise. | |
AssertLegacyTrait:: |
protected | function | Asserts that a field exists with the given name or ID. | |
AssertLegacyTrait:: |
protected | function | Asserts that a field exists with the given ID and value. | |
AssertLegacyTrait:: |
protected | function | Asserts that a field exists with the given name and value. | |
AssertLegacyTrait:: |
protected | function | Asserts that a field exists in the current page by the given XPath. | |
AssertLegacyTrait:: |
protected | function | Asserts that a checkbox field in the current page is checked. | |
AssertLegacyTrait:: |
protected | function | Asserts that a field exists in the current page with a given Xpath result. | |
AssertLegacyTrait:: |
protected | function | Checks that current response header equals value. | |
AssertLegacyTrait:: |
protected | function | Deprecated Scheduled for removal in Drupal 10.0.0. Use self::assertSame() instead. | |
AssertLegacyTrait:: |
protected | function | Deprecated Scheduled for removal in Drupal 10.0.0. Use self::assertEquals() instead. | |
AssertLegacyTrait:: |
protected | function | Passes if a link with the specified label is found. | |
AssertLegacyTrait:: |
protected | function | Passes if a link containing a given href (part) is found. | |
AssertLegacyTrait:: |
protected | function | Asserts whether an expected cache tag was absent in the last response. | |
AssertLegacyTrait:: |
protected | function | Passes if the raw text is not found escaped on the loaded page. | |
AssertLegacyTrait:: |
protected | function | Asserts that a field does NOT exist with the given name or ID. | |
AssertLegacyTrait:: |
protected | function | Asserts that a field does not exist with the given ID and value. | |
AssertLegacyTrait:: |
protected | function | Asserts that a field does not exist with the given name and value. | |
AssertLegacyTrait:: |
protected | function | Asserts that a field does not exist or its value does not match, by XPath. | |
AssertLegacyTrait:: |
protected | function | Asserts that a checkbox field in the current page is not checked. | |
AssertLegacyTrait:: |
protected | function | Passes if a link with the specified label is not found. | |
AssertLegacyTrait:: |
protected | function | Passes if a link containing a given href (part) is not found. | |
AssertLegacyTrait:: |
protected | function | Asserts that a select option does NOT exist in the current page. | |
AssertLegacyTrait:: |
protected | function | Triggers a pass if the Perl regex pattern is not found in the raw content. | |
AssertLegacyTrait:: |
protected | function | Passes if the raw text IS not found on the loaded page, fail otherwise. | 1 |
AssertLegacyTrait:: |
protected | function | Deprecated Scheduled for removal in Drupal 10.0.0. Use self::assertNotEquals() instead. | |
AssertLegacyTrait:: |
protected | function | Passes if the page (with HTML stripped) does not contains the text. | 1 |
AssertLegacyTrait:: |
protected | function | Deprecated Scheduled for removal in Drupal 10.0.0. Use self::assertNotSame() instead. | |
AssertLegacyTrait:: |
protected | function | Passes if the text is found MORE THAN ONCE on the text version of the page. | |
AssertLegacyTrait:: |
protected | function | Asserts that a select option in the current page exists. | |
AssertLegacyTrait:: |
protected | function | Asserts that a select option with the visible text exists. | |
AssertLegacyTrait:: |
protected | function | Asserts that a select option in the current page is checked. | |
AssertLegacyTrait:: |
protected | function | Triggers a pass if the Perl regex pattern is found in the raw content. | |
AssertLegacyTrait:: |
protected | function | Passes if the raw text IS found on the loaded page, fail otherwise. | 1 |
AssertLegacyTrait:: |
protected | function | Asserts the page responds with the specified response code. | 1 |
AssertLegacyTrait:: |
protected | function | Passes if the page (with HTML stripped) contains the text. | 1 |
AssertLegacyTrait:: |
protected | function | Helper for assertText and assertNoText. | |
AssertLegacyTrait:: |
protected | function | Pass if the page title is the given string. | |
AssertLegacyTrait:: |
protected | function | Passes if the text is found ONLY ONCE on the text version of the page. | |
AssertLegacyTrait:: |
protected | function | Passes if the internal browser's URL matches the given path. | |
AssertLegacyTrait:: |
protected | function | Builds an XPath query. | |
AssertLegacyTrait:: |
protected | function | Helper: Constructs an XPath for the given set of attributes and value. | |
AssertLegacyTrait:: |
protected | function | Get all option elements, including nested options, in a select. | |
AssertLegacyTrait:: |
protected | function | Gets the current raw content. | |
AssertLegacyTrait:: |
protected | function | Deprecated Scheduled for removal in Drupal 10.0.0. Use self::assertTrue() instead. | |
AssertLegacyTrait:: |
protected | function | ||
BlockCreationTrait:: |
protected | function | Creates a block instance based on default settings. Aliased as: drupalPlaceBlock | |
BrowserHtmlDebugTrait:: |
protected | property | The Base URI to use for links to the output files. | |
BrowserHtmlDebugTrait:: |
protected | property | Class name for HTML output logging. | |
BrowserHtmlDebugTrait:: |
protected | property | Counter for HTML output logging. | |
BrowserHtmlDebugTrait:: |
protected | property | Counter storage for HTML output logging. | |
BrowserHtmlDebugTrait:: |
protected | property | Directory name for HTML output logging. | |
BrowserHtmlDebugTrait:: |
protected | property | HTML output output enabled. | |
BrowserHtmlDebugTrait:: |
protected | property | The file name to write the list of URLs to. | |
BrowserHtmlDebugTrait:: |
protected | property | HTML output test ID. | |
BrowserHtmlDebugTrait:: |
protected | function | Formats HTTP headers as string for HTML output logging. | |
BrowserHtmlDebugTrait:: |
protected | function | Returns headers in HTML output format. | 1 |
BrowserHtmlDebugTrait:: |
protected | function | Logs a HTML output message in a text file. | |
BrowserHtmlDebugTrait:: |
protected | function | Creates the directory to store browser output. | |
BrowserTestBase:: |
protected | property | The base URL. | |
BrowserTestBase:: |
protected | property | The config importer that can be used in a test. | |
BrowserTestBase:: |
protected | property | An array of custom translations suitable for drupal_rewrite_settings(). | |
BrowserTestBase:: |
protected | property | The database prefix of this test run. | |
BrowserTestBase:: |
protected | property | Mink session manager. | |
BrowserTestBase:: |
protected | property | ||
BrowserTestBase:: |
protected | property | 1 | |
BrowserTestBase:: |
protected static | property | Modules to enable. | 621 |
BrowserTestBase:: |
protected | property | The original container. | |
BrowserTestBase:: |
protected | property | The original array of shutdown function callbacks. | |
BrowserTestBase:: |
protected | property | ||
BrowserTestBase:: |
protected | property | The profile to install as a basis for testing. | 39 |
BrowserTestBase:: |
protected | property | The app root. | |
BrowserTestBase:: |
protected | property | Browser tests are run in separate processes to prevent collisions between code that may be loaded by tests. | |
BrowserTestBase:: |
protected | property | Time limit in seconds for the test. | |
BrowserTestBase:: |
protected | property | The translation file directory for the test environment. | |
BrowserTestBase:: |
protected | function | Clean up the Simpletest environment. | |
BrowserTestBase:: |
protected | function | Configuration accessor for tests. Returns non-overridden configuration. | |
BrowserTestBase:: |
protected | function | Translates a CSS expression to its XPath equivalent. | |
BrowserTestBase:: |
protected | function | Gets the value of an HTTP response header. | |
BrowserTestBase:: |
protected | function | Returns all response headers. | |
BrowserTestBase:: |
public static | function | Ensures test files are deletable. | |
BrowserTestBase:: |
protected | function | Gets an instance of the default Mink driver. | |
BrowserTestBase:: |
protected | function | Gets the JavaScript drupalSettings variable for the currently-loaded page. | 1 |
BrowserTestBase:: |
protected | function | Obtain the HTTP client for the system under test. | |
BrowserTestBase:: |
protected | function | Get the Mink driver args from an environment variable, if it is set. Can be overridden in a derived class so it is possible to use a different value for a subset of tests, e.g. the JavaScript tests. | 1 |
BrowserTestBase:: |
protected | function | Helper function to get the options of select field. | |
BrowserTestBase:: |
protected | function |
Provides a Guzzle middleware handler to log every response received. Overrides BrowserHtmlDebugTrait:: |
|
BrowserTestBase:: |
public | function | Returns Mink session. | |
BrowserTestBase:: |
protected | function | Get session cookies from current session. | |
BrowserTestBase:: |
protected | function |
Retrieves the current calling line in the class under test. Overrides BrowserHtmlDebugTrait:: |
|
BrowserTestBase:: |
protected | function | Visits the front page when initializing Mink. | 3 |
BrowserTestBase:: |
protected | function | Initializes Mink sessions. | 1 |
BrowserTestBase:: |
public | function | Installs Drupal into the Simpletest site. | 1 |
BrowserTestBase:: |
protected | function | Registers additional Mink sessions. | |
BrowserTestBase:: |
protected | function | 475 | |
BrowserTestBase:: |
protected | function | 3 | |
BrowserTestBase:: |
protected | function | Transforms a nested array into a flat array suitable for drupalPostForm(). | |
BrowserTestBase:: |
protected | function | Performs an xpath search on the contents of the internal browser. | |
BrowserTestBase:: |
public | function | 1 | |
BrowserTestBase:: |
public | function | Prevents serializing any properties. | |
ConfigTestTrait:: |
protected | function | Returns a ConfigImporter object to import test configuration. | |
ConfigTestTrait:: |
protected | function | Copies configuration objects from source storage to target storage. | |
ContentTypeCreationTrait:: |
protected | function | Creates a custom content type based on default settings. Aliased as: drupalCreateContentType | 1 |
FunctionalTestSetupTrait:: |
protected | property | The flag to set 'apcu_ensure_unique_prefix' setting. | 1 |
FunctionalTestSetupTrait:: |
protected | property | The class loader to use for installation and initialization of setup. | |
FunctionalTestSetupTrait:: |
protected | property | The config directories used in this test. | |
FunctionalTestSetupTrait:: |
protected | property | The "#1" admin user. | |
FunctionalTestSetupTrait:: |
protected | function | Execute the non-interactive installer. | 1 |
FunctionalTestSetupTrait:: |
protected | function | Returns all supported database driver installer objects. | |
FunctionalTestSetupTrait:: |
protected | function | Initialize various configurations post-installation. | 2 |
FunctionalTestSetupTrait:: |
protected | function | Initializes the kernel after installation. | |
FunctionalTestSetupTrait:: |
protected | function | Initialize settings created during install. | |
FunctionalTestSetupTrait:: |
protected | function | Initializes user 1 for the site to be installed. | |
FunctionalTestSetupTrait:: |
protected | function | Installs the default theme defined by `static::$defaultTheme` when needed. | |
FunctionalTestSetupTrait:: |
protected | function | Install modules defined by `static::$modules`. | 1 |
FunctionalTestSetupTrait:: |
protected | function | Returns the parameters that will be used when Simpletest installs Drupal. | 9 |
FunctionalTestSetupTrait:: |
protected | function | Prepares the current environment for running the test. | 23 |
FunctionalTestSetupTrait:: |
protected | function | Creates a mock request and sets it on the generator. | |
FunctionalTestSetupTrait:: |
protected | function | Prepares site settings and services before installation. | 2 |
FunctionalTestSetupTrait:: |
protected | function | Resets and rebuilds the environment after setup. | |
FunctionalTestSetupTrait:: |
protected | function | Rebuilds \Drupal::getContainer(). | |
FunctionalTestSetupTrait:: |
protected | function | Resets all data structures after having enabled new modules. | |
FunctionalTestSetupTrait:: |
protected | function | Changes parameters in the services.yml file. | |
FunctionalTestSetupTrait:: |
protected | function | Sets up the base URL based upon the environment variable. | |
FunctionalTestSetupTrait:: |
protected | function | Rewrites the settings.php file of the test site. | |
NodeCreationTrait:: |
protected | function | Creates a node based on default settings. Aliased as: drupalCreateNode | |
NodeCreationTrait:: |
public | function | Get a node from the database based on its title. Aliased as: drupalGetNodeByTitle | |
PhpunitCompatibilityTrait:: |
public | function | Returns a mock object for the specified class using the available method. | |
PhpunitCompatibilityTrait:: |
public | function | Compatibility layer for PHPUnit 6 to support PHPUnit 4 code. | |
RandomGeneratorTrait:: |
protected | property | The random generator. | |
RandomGeneratorTrait:: |
protected | function | Gets the random generator for the utility methods. | |
RandomGeneratorTrait:: |
protected | function | Generates a unique random string containing letters and numbers. | 1 |
RandomGeneratorTrait:: |
public | function | Generates a random PHP object. | |
RandomGeneratorTrait:: |
public | function | Generates a pseudo-random string of ASCII characters of codes 32 to 126. | |
RandomGeneratorTrait:: |
public | function | Callback for random string validation. | |
RefreshVariablesTrait:: |
protected | function | Refreshes in-memory configuration and state information. | 3 |
SessionTestTrait:: |
protected | property | The name of the session cookie. | |
SessionTestTrait:: |
protected | function | Generates a session cookie name. | |
SessionTestTrait:: |
protected | function | Returns the session name in use on the child site. | |
SitesDirectoryHardeningTest:: |
protected | property |
The theme to install as the default for testing. Overrides BrowserTestBase:: |
|
SitesDirectoryHardeningTest:: |
protected | function | Checks system runtime requirements. | |
SitesDirectoryHardeningTest:: |
protected | function | Makes the given path and settings file writable. | |
SitesDirectoryHardeningTest:: |
protected | function | Returns the path to settings.php | |
SitesDirectoryHardeningTest:: |
public | function | Tests the default behavior to restrict directory permissions is enforced. | |
SitesDirectoryHardeningTest:: |
public | function | Tests writable files remain writable when directory hardening is disabled. | |
StorageCopyTrait:: |
protected static | function | Copy the configuration from one storage to another and remove stale items. | |
StringTranslationTrait:: |
protected | property | The string translation service. | 1 |
StringTranslationTrait:: |
protected | function | Formats a string containing a count of items. | |
StringTranslationTrait:: |
protected | function | Returns the number of plurals supported by a given language. | |
StringTranslationTrait:: |
protected | function | Gets the string translation service. | |
StringTranslationTrait:: |
public | function | Sets the string translation service to use. | 2 |
StringTranslationTrait:: |
protected | function | Translates a string to the current language or to a given language. | |
TestRequirementsTrait:: |
private | function | Checks missing module requirements. | |
TestRequirementsTrait:: |
protected | function | Check module requirements for the Drupal use case. | 1 |
TestRequirementsTrait:: |
protected static | function | Returns the Drupal root directory. | |
TestSetupTrait:: |
protected static | property | An array of config object names that are excluded from schema checking. | |
TestSetupTrait:: |
protected | property | The dependency injection container used in the test. | |
TestSetupTrait:: |
protected | property | The DrupalKernel instance used in the test. | |
TestSetupTrait:: |
protected | property | The site directory of the original parent site. | |
TestSetupTrait:: |
protected | property | The private file directory for the test environment. | |
TestSetupTrait:: |
protected | property | The public file directory for the test environment. | |
TestSetupTrait:: |
protected | property | The site directory of this test run. | |
TestSetupTrait:: |
protected | property | Set to TRUE to strict check all configuration saved. | 2 |
TestSetupTrait:: |
protected | property | The temporary file directory for the test environment. | |
TestSetupTrait:: |
protected | property | The test run ID. | |
TestSetupTrait:: |
protected | function | Changes the database connection to the prefixed one. | |
TestSetupTrait:: |
protected | function | Gets the config schema exclusions for this test. | |
TestSetupTrait:: |
public static | function | Returns the database connection to the site running Simpletest. | |
TestSetupTrait:: |
protected | function | Generates a database prefix for running tests. | 2 |
UiHelperTrait:: |
protected | property | The current user logged in using the Mink controlled browser. | |
UiHelperTrait:: |
protected | property | The number of meta refresh redirects to follow, or NULL if unlimited. | |
UiHelperTrait:: |
protected | property | The number of meta refresh redirects followed during ::drupalGet(). | |
UiHelperTrait:: |
public | function | Returns WebAssert object. | 1 |
UiHelperTrait:: |
protected | function | Builds an a absolute URL from a system path or a URL object. | |
UiHelperTrait:: |
protected | function | Checks for meta refresh tag and if found call drupalGet() recursively. | |
UiHelperTrait:: |
protected | function | Clicks the element with the given CSS selector. | |
UiHelperTrait:: |
protected | function | Follows a link by complete name. | |
UiHelperTrait:: |
protected | function | Searches elements using a CSS selector in the raw content. | |
UiHelperTrait:: |
protected | function | Retrieves a Drupal path or an absolute path. | 3 |
UiHelperTrait:: |
protected | function | Logs in a user using the Mink controlled browser. | |
UiHelperTrait:: |
protected | function | Logs a user out of the Mink controlled browser and confirms. | |
UiHelperTrait:: |
protected | function | Executes a form submission. | |
UiHelperTrait:: |
protected | function | Returns whether a given user account is logged in. | |
UiHelperTrait:: |
protected | function | Takes a path and returns an absolute path. | |
UiHelperTrait:: |
protected | function | Retrieves the plain-text content from the current page. | |
UiHelperTrait:: |
protected | function | Get the current URL from the browser. | |
UiHelperTrait:: |
protected | function | Prepare for a request to testing site. | 1 |
UiHelperTrait:: |
protected | function | Fills and submits a form. | |
UserCreationTrait:: |
protected | function | Checks whether a given list of permission names is valid. | |
UserCreationTrait:: |
protected | function | Creates an administrative role. | |
UserCreationTrait:: |
protected | function | Creates a role with specified permissions. Aliased as: drupalCreateRole | |
UserCreationTrait:: |
protected | function | Create a user with a given set of permissions. Aliased as: drupalCreateUser | |
UserCreationTrait:: |
protected | function | Grant permissions to a user role. | |
UserCreationTrait:: |
protected | function | Switch the current logged in user. | |
UserCreationTrait:: |
protected | function | Creates a random user account and sets it as current user. | |
XdebugRequestTrait:: |
protected | function | Adds xdebug cookies, from request setup. |