View source
<?php
namespace Drupal\Tests\user\Functional;
use Drupal\Component\Render\FormattableMarkup;
use Drupal\Core\Database\Database;
use Drupal\Core\Test\AssertMailTrait;
use Drupal\Core\Url;
use Drupal\Tests\BrowserTestBase;
use Drupal\user\Entity\User;
class UserPasswordResetTest extends BrowserTestBase {
use AssertMailTrait {
getMails as drupalGetMails;
}
protected $account;
public static $modules = [
'block',
];
protected $defaultTheme = 'stark';
protected function setUp() {
parent::setUp();
$config = $this
->config('system.performance');
$config
->set('cache.page.max_age', 3600);
$config
->save();
$this
->drupalPlaceBlock('system_menu_block:account');
$account = $this
->drupalCreateUser();
$this
->drupalLogin($account);
$this->account = User::load($account
->id());
$this->account->passRaw = $account->passRaw;
$this
->drupalLogout();
$account->login = REQUEST_TIME - mt_rand(10, 100000);
Database::getConnection()
->update('users_field_data')
->fields([
'login' => $account
->getLastLoginTime(),
])
->condition('uid', $account
->id())
->execute();
}
public function testUserPasswordReset() {
$this
->drupalGet(Url::fromRoute('user.reset.form', [
'uid' => $this->account
->id(),
]));
$this
->assertSession()
->statusCodeEquals(403);
$this
->drupalGet('user/password');
$edit = [
'name' => $this
->randomMachineName(),
];
$this
->drupalPostForm(NULL, $edit, t('Submit'));
$this
->assertNoValidPasswordReset($edit['name']);
$this
->drupalGet('user/password');
$edit = [
'name' => $this->account
->getAccountName(),
];
$this
->drupalPostForm(NULL, $edit, t('Submit'));
$this
->assertValidPasswordReset($edit['name']);
$resetURL = $this
->getResetURL();
$this
->drupalGet($resetURL);
$this
->assertUrl(Url::fromRoute('user.reset.form', [
'uid' => $this->account
->id(),
]));
$this
->assertNull($this
->drupalGetHeader('X-Drupal-Cache'));
$this
->drupalGet($resetURL);
$this
->assertNull($this
->drupalGetHeader('X-Drupal-Cache'));
$this
->assertText($this->account
->getAccountName(), 'One-time login page contains the correct username.');
$this
->assertText(t('This login can be used only once.'), 'Found warning about one-time login.');
$this
->assertTitle('Reset password | Drupal');
$this
->drupalPostForm(NULL, NULL, t('Log in'));
$this
->assertSession()
->linkExists(t('Log out'));
$this
->assertTitle($this->account
->getAccountName() . ' | Drupal');
$password = user_password();
$edit = [
'pass[pass1]' => $password,
'pass[pass2]' => $password,
];
$this
->drupalPostForm(NULL, $edit, t('Save'));
$this
->assertText(t('The changes have been saved.'), 'Forgotten password changed.');
$this
->drupalPostForm(NULL, $edit, t('Save'));
$this
->assertText(t("Your current password is missing or incorrect; it's required to change the Password."), 'Password needed to make profile changes.');
$this
->drupalLogout();
$this
->drupalGet($resetURL);
$this
->drupalPostForm(NULL, NULL, t('Log in'));
$this
->assertText(t('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.'), 'One-time link is no longer valid.');
$before = count($this
->drupalGetMails([
'id' => 'user_password_reset',
]));
$this
->drupalGet('user/password');
$edit = [
'name' => $this->account
->getEmail(),
];
$this
->drupalPostForm(NULL, $edit, t('Submit'));
$this
->assertValidPasswordReset($edit['name']);
$this
->assertCount($before + 1, $this
->drupalGetMails([
'id' => 'user_password_reset',
]), 'Email sent when requesting password reset using email address.');
$resetURL = $this
->getResetURL();
$this
->drupalGet($resetURL);
$this
->drupalPostForm(NULL, NULL, t('Log in'));
$this
->drupalGet('user/' . $this->account
->id() . '/edit');
$this
->assertNoText('Expected user_string to be a string, NULL given');
$this
->drupalLogout();
$timeout = $this
->config('user.settings')
->get('password_reset_timeout');
$bogus_timestamp = REQUEST_TIME - $timeout - 60;
$_uid = $this->account
->id();
$this
->drupalGet("user/reset/{$_uid}/{$bogus_timestamp}/" . user_pass_rehash($this->account, $bogus_timestamp));
$this
->drupalPostForm(NULL, NULL, t('Log in'));
$this
->assertText(t('You have tried to use a one-time login link that has expired. Please request a new one using the form below.'), 'Expired password reset request rejected.');
$timestamp = REQUEST_TIME - 1;
$blocked_account = $this
->drupalCreateUser()
->block();
$blocked_account
->save();
$this
->drupalGet("user/reset/" . $blocked_account
->id() . "/{$timestamp}/" . user_pass_rehash($blocked_account, $timestamp));
$this
->assertSession()
->statusCodeEquals(403);
$this
->drupalGet('user/password');
$before = count($this
->drupalGetMails([
'id' => 'user_password_reset',
]));
$edit = [
'name' => $blocked_account
->getAccountName(),
];
$this
->drupalPostForm(NULL, $edit, t('Submit'));
$this
->assertRaw(t('%name is blocked or has not been activated yet.', [
'%name' => $blocked_account
->getAccountName(),
]), 'Notified user blocked accounts can not request a new password');
$this
->assertCount($before, $this
->drupalGetMails([
'id' => 'user_password_reset',
]), 'No email was sent when requesting password reset for a blocked account');
$this
->drupalGet('user/password');
$edit = [
'name' => $this->account
->getAccountName(),
];
$this
->drupalPostForm(NULL, $edit, t('Submit'));
$old_email_reset_link = $this
->getResetURL();
$this->account
->setEmail("1" . $this->account
->getEmail());
$this->account
->save();
$this
->drupalGet($old_email_reset_link);
$this
->drupalPostForm(NULL, NULL, t('Log in'));
$this
->assertText(t('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.'), 'One-time link is no longer valid.');
$this
->drupalGet('user/password');
$edit = [
'name' => $this->account
->getAccountName(),
];
$this
->drupalPostForm(NULL, $edit, t('Submit'));
$reset_url = $this
->getResetURL();
$this
->drupalGet($reset_url . '/login');
$this
->assertSession()
->linkExists(t('Log out'));
$this
->assertTitle($this->account
->getAccountName() . ' | Drupal');
$this
->drupalLogout();
$timestamp = REQUEST_TIME - 1;
$blocked_account = $this
->drupalCreateUser()
->block();
$blocked_account
->save();
$this
->drupalGet("user/reset/" . $blocked_account
->id() . "/{$timestamp}/" . user_pass_rehash($blocked_account, $timestamp) . '/login');
$this
->assertSession()
->statusCodeEquals(403);
$blocked_account
->delete();
$this
->drupalGet("user/reset/" . $blocked_account
->id() . "/{$timestamp}/" . user_pass_rehash($blocked_account, $timestamp) . '/login');
$this
->assertSession()
->statusCodeEquals(403);
}
public function getResetURL() {
$_emails = $this
->drupalGetMails();
$email = end($_emails);
$urls = [];
preg_match('#.+user/reset/.+#', $email['body'], $urls);
return $urls[0];
}
public function testUserPasswordResetLoggedIn() {
$another_account = $this
->drupalCreateUser();
$this
->drupalLogin($another_account);
$this
->drupalGet('user/password');
$this
->drupalPostForm(NULL, NULL, t('Submit'));
$resetURL = $this
->getResetURL();
$this
->drupalLogin($this->account);
$this
->drupalGet($resetURL);
$this
->assertRaw(new FormattableMarkup('Another user (%other_user) is already logged into the site on this computer, but you tried to use a one-time link for user %resetting_user. Please <a href=":logout">log out</a> and try using the link again.', [
'%other_user' => $this->account
->getAccountName(),
'%resetting_user' => $another_account
->getAccountName(),
':logout' => Url::fromRoute('user.logout')
->toString(),
]));
$another_account
->delete();
$this
->drupalGet($resetURL);
$this
->assertText('The one-time login link you clicked is invalid.');
$this
->drupalLogin($this->account);
$this
->drupalGet('user/password');
$this
->drupalPostForm(NULL, NULL, t('Submit'));
$resetURL = $this
->getResetURL();
$this
->drupalGet($resetURL);
$this
->drupalPostForm(NULL, NULL, t('Log in'));
$password = user_password();
$edit = [
'pass[pass1]' => $password,
'pass[pass2]' => $password,
];
$this
->drupalPostForm(NULL, $edit, t('Save'));
$this
->assertText(t('The changes have been saved.'), 'Password changed.');
$timestamp = REQUEST_TIME - 1;
$this
->drupalGet("user/reset/" . $this->account
->id() . "/{$timestamp}/" . user_pass_rehash($this->account, $timestamp) . '/login');
$this
->assertSession()
->statusCodeEquals(403);
$this
->drupalGet("user/reset/" . $this->account
->id());
$this
->assertSession()
->statusCodeEquals(403);
}
public function testUserResetPasswordTextboxFilled() {
$this
->drupalGet('user/login');
$edit = [
'name' => $this
->randomMachineName(),
'pass' => $this
->randomMachineName(),
];
$this
->drupalPostForm('user/login', $edit, t('Log in'));
$this
->assertRaw(t('Unrecognized username or password. <a href=":password">Forgot your password?</a>', [
':password' => Url::fromRoute('user.pass', [], [
'query' => [
'name' => $edit['name'],
],
])
->toString(),
]));
unset($edit['pass']);
$this
->drupalGet('user/password', [
'query' => [
'name' => $edit['name'],
],
]);
$this
->assertFieldByName('name', $edit['name'], 'User name found.');
$this
->drupalGet('user/password');
$this
->assertNoFieldByName('name', $edit['name'], 'User name not found.');
}
public function testUserResetPasswordUserFloodControl() {
\Drupal::configFactory()
->getEditable('user.flood')
->set('user_limit', 3)
->save();
$edit = [
'name' => $this->account
->getAccountName(),
];
for ($i = 0; $i < 3; $i++) {
$this
->drupalGet('user/password');
$this
->drupalPostForm(NULL, $edit, t('Submit'));
$this
->assertValidPasswordReset($edit['name']);
$this
->assertNoPasswordUserFlood();
}
$this
->drupalGet('user/password');
$this
->drupalPostForm(NULL, $edit, t('Submit'));
$this
->assertPasswordUserFlood();
}
public function testUserResetPasswordIpFloodControl() {
\Drupal::configFactory()
->getEditable('user.flood')
->set('ip_limit', 3)
->save();
for ($i = 0; $i < 3; $i++) {
$this
->drupalGet('user/password');
$edit = [
'name' => $this
->randomMachineName(),
];
$this
->drupalPostForm(NULL, $edit, t('Submit'));
$this
->assertNoValidPasswordReset($edit['name']);
$this
->assertNoPasswordIpFlood();
}
$this
->drupalGet('user/password');
$edit = [
'name' => $this
->randomMachineName(),
];
$this
->drupalPostForm(NULL, $edit, t('Submit'));
$this
->assertPasswordIpFlood();
}
public function testUserResetPasswordUserFloodControlIsCleared() {
\Drupal::configFactory()
->getEditable('user.flood')
->set('user_limit', 3)
->save();
$edit = [
'name' => $this->account
->getAccountName(),
];
for ($i = 0; $i < 3; $i++) {
$this
->drupalGet('user/password');
$this
->drupalPostForm(NULL, $edit, t('Submit'));
$this
->assertValidPasswordReset($edit['name']);
$this
->assertNoPasswordUserFlood();
}
$reset_url = $this
->getResetURL();
$this
->drupalGet($reset_url . '/login');
$this
->assertSession()
->linkExists(t('Log out'));
$this
->assertTitle($this->account
->getAccountName() . ' | Drupal');
$this
->drupalLogout();
$this
->drupalGet('user/password');
$this
->drupalPostForm(NULL, $edit, t('Submit'));
$this
->assertValidPasswordReset($edit['name']);
$this
->assertNoPasswordUserFlood();
}
public function assertValidPasswordReset($name) {
$this
->assertNoText(t('Sorry, @name is not recognized as a username or an e-mail address.', [
'@name' => $name,
]), 'Validation error message shown when trying to request password for invalid account.');
$this
->assertMail('to', $this->account
->getEmail(), 'Password e-mail sent to user.');
$subject = t('Replacement login information for @username at @site', [
'@username' => $this->account
->getAccountName(),
'@site' => \Drupal::config('system.site')
->get('name'),
]);
$this
->assertMail('subject', $subject, 'Password reset e-mail subject is correct.');
}
public function assertNoValidPasswordReset($name) {
$this
->assertText(t('@name is not recognized as a username or an email address.', [
'@name' => $name,
]), 'Validation error message shown when trying to request password for invalid account.');
$this
->assertCount(0, $this
->drupalGetMails([
'id' => 'user_password_reset',
]), 'No e-mail was sent when requesting a password for an invalid account.');
}
public function assertPasswordUserFlood() {
$this
->assertText(t('Too many password recovery requests for this account. It is temporarily blocked. Try again later or contact the site administrator.'), 'User password reset flood error message shown.');
}
public function assertNoPasswordUserFlood() {
$this
->assertNoText(t('Too many password recovery requests for this account. It is temporarily blocked. Try again later or contact the site administrator.'), 'User password reset flood error message not shown.');
}
public function assertPasswordIpFlood() {
$this
->assertText(t('Too many password recovery requests from your IP address. It is temporarily blocked. Try again later or contact the site administrator.'), 'IP password reset flood error message shown.');
}
public function assertNoPasswordIpFlood() {
$this
->assertNoText(t('Too many password recovery requests from your IP address. It is temporarily blocked. Try again later or contact the site administrator.'), 'IP password reset flood error message not shown.');
}
public function testResetImpersonation() {
$edit = [];
$edit['name'] = $this
->randomMachineName();
$edit['mail'] = $edit['name'] . '@example.com';
$edit['status'] = 1;
$user1 = User::create($edit);
$user1
->save();
$edit['name'] = $this
->randomMachineName();
$user2 = User::create($edit);
$user2
->save();
Database::getConnection()
->update('users_field_data')
->fields([
'pass' => NULL,
])
->condition('uid', [
$user1
->id(),
$user2
->id(),
], 'IN')
->execute();
\Drupal::entityTypeManager()
->getStorage('user')
->resetCache();
$user1 = User::load($user1
->id());
$user2 = User::load($user2
->id());
$this
->assertEqual($user1
->getPassword(), $user2
->getPassword(), 'Both users have the same password hash.');
$reset_url = user_pass_reset_url($user1);
$attack_reset_url = str_replace("user/reset/{$user1->id()}", "user/reset/{$user2->id()}", $reset_url);
$this
->drupalGet($attack_reset_url);
$this
->drupalPostForm(NULL, NULL, t('Log in'));
$this
->assertNoText($user2
->getAccountName(), 'The invalid password reset page does not show the user name.');
$this
->assertUrl('user/password', [], 'The user is redirected to the password reset request page.');
$this
->assertText('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.');
}
}