access.test in Views data export 7.3

File

tests/access.test

<?php

/**
 * Test class for access checks for VDE downloads.
 *
 * Views Data Export enforces that a previously exported file may only be
 * re-downloaded by the user that created the export. We test for that with
 * this class.
 */
class ViewsDataExportAccessTest extends ViewsDataExportBaseTest {
  protected $profile = 'testing';
  public static function getInfo() {
    return array(
      'name' => 'Access to temp files',
      'description' => 'Check access to created export files.',
      'group' => 'Views Data Export',
    );
  }

  /**
   * Test that VDE export can only be downloaded by the user that created them.
   */
  public function testExportedTempFileAccess() {
    $this->admin_user1 = $this
      ->drupalCreateUser();
    $this->admin_user2 = $this
      ->drupalCreateUser();

    // Run a batched export.
    $path = 'vde_test/' . $this
      ->randomName();
    list($view, $expected) = $this
      ->getExportView($path);
    $display =& $view->display['vde_test']->handler;

    // Set this view to be batched.
    $display
      ->override_option('use_batch', 'batch');

    // Save this view so we can hit the path.
    $view
      ->save();

    // Ensure that the menu router system is rebuilt on the next page load.
    variable_set('menu_rebuild_needed', TRUE);
    $this
      ->drupalLogin($this->admin_user1);

    // Catpure the session_id as the redirects in the request ditch it.
    $session_id = $this->session_id;
    $this
      ->assertBatchedExportEqual($path, $expected, 'Batched access export matched expected output.');

    // Remove all the test data, so future exports will be different.
    db_truncate('views_test')
      ->execute();
    $this
      ->resetAll();

    // Assert that we can re-download directly when supplying the token.
    // We rely on this being the first export in this test class.
    // Restore the session_id from above so we can use drupalGetToken.
    $this->session_id = $session_id;
    $token = $this
      ->drupalGetToken('views_data_export/1');
    $this
      ->drupalGet($path, array(
      'query' => array(
        'eid' => 1,
        'download' => 1,
        'token' => $token,
      ),
    ));
    $output = $this
      ->drupalGetContent();
    $this
      ->assertEqual($this
      ->normaliseString($output), $expected, 'Re-download of export file by original user is possible with session token.');

    // Assert that we cannot re-download directly without supplying the token.
    // We rely on this being the first export in this test class.
    $this
      ->drupalGet($path, array(
      'query' => array(
        'eid' => 1,
        'download' => 1,
      ),
    ));
    $output = $this
      ->drupalGetContent();
    $this
      ->assertEqual($this
      ->normaliseString($output), '', 'Re-download of export file by original user is not possible.');

    // Assert that someone else can't download our file.
    // We rely on this being the first export in this test class.
    $this
      ->drupalLogin($this->admin_user2);
    $this
      ->drupalGet($path, array(
      'query' => array(
        'eid' => 1,
        'download' => 1,
        'token' => $token,
      ),
    ));
    $output = $this
      ->drupalGetContent();
    $this
      ->assertEqual($this
      ->normaliseString($output), '', 'Re-download of export file by different user is not possible.');
  }

  /**
   * Overrides DrupalWebTestCase::drupalGetToken() to support the hash salt.
   *
   * @todo Remove when http://drupal.org/node/1555862 is fixed in core.
   */
  protected function drupalGetToken($value = '') {
    $private_key = drupal_get_private_key();
    return drupal_hmac_base64($value, $this->session_id . $private_key . drupal_get_hash_salt());
  }

  /**
   * Build and return a basic view of the views_test table.
   *
   * @return view
   */
  protected function getBasicExportView() {
    views_include('view');

    // Create the basic view.
    $view = new view();
    $view->vid = 'new';
    $view->base_table = 'views_test';

    // Set up the fields we need.
    $display = $view
      ->new_display('default', 'Master', 'default');
    $display
      ->override_option('fields', array(
      'id' => array(
        'id' => 'id',
        'table' => 'views_test',
        'field' => 'id',
        'relationship' => 'none',
      ),
      'name' => array(
        'id' => 'name',
        'table' => 'views_test',
        'field' => 'name',
        'relationship' => 'none',
      ),
      'age' => array(
        'id' => 'age',
        'table' => 'views_test',
        'field' => 'age',
        'relationship' => 'none',
      ),
    ));

    // Set up the sort order.
    $display
      ->override_option('sorts', array(
      'id' => array(
        'order' => 'ASC',
        'id' => 'id',
        'table' => 'views_test',
        'field' => 'id',
        'relationship' => 'none',
      ),
    ));

    // Set up the pager.
    $display
      ->override_option('pager', array(
      'type' => 'none',
      'options' => array(
        'offset' => 0,
      ),
    ));
    return $view;
  }
  protected function getStylePluginName() {
    return 'views_data_export_txt';
  }
  protected function getExportView($path = 'vde_test') {

    // Create the basic view.
    $view = $this
      ->getBasicExportView();
    $display = $view
      ->new_display('views_data_export', 'Data export', 'vde_test');
    $display
      ->override_option('style_plugin', $this
      ->getStylePluginName());
    $display
      ->override_option('path', $path);
    $expected = '[ID]

1
[Name]

John
[Age]

25
----------------------------------------

[ID]

2
[Name]

George
[Age]

27
----------------------------------------

[ID]

3
[Name]

Ringo
[Age]

28
----------------------------------------

[ID]

4
[Name]

Paul
[Age]

26
----------------------------------------

[ID]

5
[Name]

Meredith
[Age]

30
----------------------------------------';
    return array(
      &$view,
      $expected,
    );
  }

}

Classes

Name	Description
ViewsDataExportAccessTest	Test class for access checks for VDE downloads.