public function TokenBrowserAccessTestCase::testTokenEndpointAccess

Tests that individual tokens are only accessible with a security token.

File

core/modules/simpletest/tests/token.test, line 1071

Test integration for the token module.

Class

TokenBrowserAccessTestCase

Tests access to the token browser tree.

Code

public function testTokenEndpointAccess() {
  $admin_user = $this->backdropCreateUser(array('administer site configuration'));
  $this->backdropLogin($admin_user);

  // The page containing the token browser link provides the security token.
  $this->backdropGet('admin/config/development/maintenance');
  $settings = $this->backdropGetSettings();
  $tree_link = $this->xpath('//a[contains(@class, :class)]', array(':class' => 'token-browser-link'));
  $tree_query = backdrop_parse_url((string) $tree_link[0]['href']);
  $query = array(
    'ancestors' => backdrop_json_encode(array('site')),
    'token' => $settings['tokenBrowser']['token'],
    'show_restricted' => 'false',
  );
  $tokens = backdrop_json_decode($this->backdropGet('token-browser/token/site', array('query' => $query)));
  $this->assertResponse(200, 'Tokens are accessible with a valid security token.');
  $this->assertEqual($tokens['name']['raw'], '[site:name]', 'Tokens are listed with a valid security token.');

  // Requests without a token are denied.
  $this->backdropGet('token-browser/token/site', array('query' => array('token' => NULL) + $query));
  $this->assertResponse(403, 'Tokens are not accessible without a security token.');
  $this->assertNoRaw('[site:name]', 'Tokens are not listed without a security token.');

  // Requests with an invalid token are denied.
  $invalid_query = array('token' => $this->randomName(43)) + $query;
  $this->backdropGet('token-browser/token/site', array('query' => $invalid_query));
  $this->assertResponse(403, 'Tokens are not accessible with an invalid security token.');

  // A token meant for the token tree is not accepted.
  $invalid_query = array('token' => $tree_query['query']['token']) + $query;
  $this->backdropGet('token-browser/token/site', array('query' => $invalid_query));
  $this->assertResponse(403, 'Tokens are not accessible with a security token for a different purpose.');

  // A token is only valid for the session for which it was generated.
  $this->backdropLogout();
  $this->backdropGet('token-browser/token/site', array('query' => $query));
  $this->assertResponse(403, 'Tokens are not accessible with a security token from another session.');
  $this->assertNoRaw('[site:name]', 'Tokens are not listed with a security token from another session.');
}