public function TokenBrowserAccessTestCase::testTokenTreeAccess

Tests that the token tree is only accessible with a valid security token.

File

core/modules/simpletest/tests/token.test, line 1029

Test integration for the token module.

Class

TokenBrowserAccessTestCase

Tests access to the token browser tree.

Code

public function testTokenTreeAccess() {
  $admin_user = $this->backdropCreateUser(array('administer site configuration'));
  $this->backdropLogin($admin_user);

  // Following the link provided within a form includes a valid token.
  $this->backdropGet('admin/config/development/maintenance');
  $settings = $this->backdropGetSettings();
  $this->clickLink(t('Browse available tokens.'));
  $this->assertResponse(200, 'Token tree is accessible with a valid security token.');
  $this->assertRaw('data-type="site"', 'Token types are listed in the token tree.');
  $query = backdrop_parse_url($this->getUrl());
  $query = $query['query'];
  $this->assertTrue(!empty($query['token']), 'Token tree link contains a security token.');

  // Requests without a token are denied.
  $this->backdropGet('token/tree');
  $this->assertResponse(403, 'Token tree is not accessible without a security token.');
  $this->backdropGet('token/tree', array('query' => array('token_types' => '"all"')));
  $this->assertResponse(403, 'All token types are not accessible without a security token.');
  $this->assertNoRaw('data-type="site"', 'Token types are not listed without a security token.');

  // Requests with an invalid token are denied.
  $invalid_query = array('token' => $this->randomName(43)) + $query;
  $this->backdropGet('token/tree', array('query' => $invalid_query));
  $this->assertResponse(403, 'Token tree is not accessible with an invalid security token.');

  // A token meant for the individual token endpoint is not accepted.
  $invalid_query = array('token' => $settings['tokenBrowser']['token']) + $query;
  $this->backdropGet('token/tree', array('query' => $invalid_query));
  $this->assertResponse(403, 'Token tree is not accessible with a security token for a different purpose.');

  // A token is only valid for the session for which it was generated.
  $this->backdropLogout();
  $this->backdropGet('token/tree', array('query' => $query));
  $this->assertResponse(403, 'Token tree is not accessible with a security token from another session.');
  $this->backdropGet('token/tree', array('query' => array('token_types' => '"all"')));
  $this->assertResponse(403, 'Token tree is not accessible to anonymous users without a security token.');
}