user.test

<?php
/**
 * @file
 * Tests for user.module.
 */

include_once(BACKDROP_ROOT . '/core/modules/simpletest/tests/system_config_test.inc');

class UserLoginTestBase extends BackdropWebTestCase {
  protected $profile = 'minimal';

  function setUp() {
    parent::setUp('dblog', 'user_flood_test');
  }

  /**
   * Make an unsuccessful login attempt.
   *
   * @param User $account
   *   A user object with name and pass_raw attributes for the login attempt.
   * @param bool $by_email
   *   Fail with an incorrect email instead of username.
   * @param $incorrect_pass
   *   Fail because of an incorrect password.
   * @param $flood_trigger
   *   Whether or not to expect that the flood control mechanism will be
   *   triggered..
   */
  function assertFailedLogin($account, $by_email = FALSE, $incorrect_pass = FALSE, $flood_trigger = NULL) {
    if ($this->loggedInUser) {
      $this->backdropLogout();
    }
    $edit = array(
      'name' => $by_email ? $account->mail : $account->name,
      'pass' => $account->pass_raw,
    );
    $this->backdropPost('user', $edit, t('Log in'));
    $this->assertNoFieldByXPath("//input[@name='pass' and @value!='']", NULL, 'Password value attribute is blank.');
    if (isset($flood_trigger)) {
      $this->assertResponse(403);
      $user_log = db_query_range('SELECT message FROM {watchdog} WHERE type = :type ORDER BY wid DESC', 0, 1, array(':type' => 'user'))->fetchField();
      $user_flood_test_log = db_query_range('SELECT message FROM {watchdog} WHERE type = :type ORDER BY wid DESC', 0, 1, array(':type' => 'user_flood_test'))->fetchField();
      if ($flood_trigger == 'user') {
        $this->assertRaw(t('Sorry, there have been more than @count failed login attempts for this account. It is temporarily blocked. Try again later or <a href="@url">request a new password</a>.', array('@url' => url('user/password'), '@count' => config_get('user.flood', 'flood_user_limit'))));
        $this->assertEqual('Flood control blocked login attempt for %user from %ip.', $user_log, 'A watchdog message was logged for the login attempt blocked by flood control per user');
        $this->assertEqual('hook_user_flood_control was passed username %username and IP %ip.', $user_flood_test_log, 'hook_user_flood_control was invoked by flood control per user');
      }
      else {
        // No UID, so the limit is IP-based.
        $this->assertRaw(t('Sorry, too many failed login attempts from your IP address. This IP address is temporarily blocked. Try again later or <a href="@url">request a new password</a>.', array('@url' => url('user/password'))));
        $this->assertEqual('Flood control blocked login attempt from %ip.', $user_log, 'A watchdog message was logged for the login attempt blocked by flood control per IP');
        $this->assertEqual('hook_user_flood_control was passed IP %ip.', $user_flood_test_log, 'hook_user_flood_control was invoked by flood control per IP');
      }
    }
    elseif ($incorrect_pass) {
      $this->assertRaw(t('Sorry, incorrect password. <a href="@password">Have you forgotten your password?</a>', array('@password' => url('user/password', array('query' => array('name' => $edit['name']))))));
    }
    else {
      $login_method = config_get('system.core', 'user_login_method');
      switch ($login_method) {
        case USER_LOGIN_EMAIL_ONLY:
          if (!$by_email) {
            $this->assertRaw(t('The email address %email is not valid.', array('%email' => $account->name)));
          }
          else {
            $this->assertRaw(t('Sorry, no account with that email address found.'));
          }
          break;
        case USER_LOGIN_USERNAME_OR_EMAIL:
          if (!$by_email) {
            $this->assertRaw(t('Sorry, unrecognized username.'));
          }
          else {
            $this->assertRaw(t('Sorry, no account with that email address found.'));
          }
          break;
        case USER_LOGIN_USERNAME_ONLY:
        default:
          $this->assertRaw(t('Sorry, unrecognized username.'));
      }
    }
  }
}

class UserRegistrationTestCase extends UserLoginTestBase {
  protected $profile = 'testing';

  function testRegistrationWithEmailVerification() {
    $config = config('system.core');

    // Require email verification.
    $config->set('user_email_verification', TRUE);
    // Set registration to administrator only.
    $config->set('user_register', USER_REGISTER_ADMINISTRATORS_ONLY);
    $config->save();

    $this->backdropGet('user/register');
    $this->assertResponse(403, 'Registration page is inaccessible when only administrators can create accounts.');

    // Allow registration by site visitors without administrator approval.
    $config->set('user_register', USER_REGISTER_VISITORS)->save();
    $edit = array();
    $edit['name'] = $name = $this->randomName();
    $edit['mail'] = $mail = $edit['name'] . '@example.com';
    $this->backdropPost('user/register', $edit, t('Create new account'));
    $this->assertText(t('A welcome message with further instructions has been sent to your email address.'), 'User registered successfully.');
    $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));
    $new_user = reset($accounts);
    $this->assertTrue($new_user->status, 'New account is active after registration.');

    // Allow registration by site visitors, but require administrator approval.
    $config->set('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL)->save();
    $edit = array();
    $edit['name'] = $name = $this->randomName();
    $edit['mail'] = $mail = $edit['name'] . '@example.com';
    $this->backdropPost('user/register', $edit, t('Create new account'));
    $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));
    $new_user = reset($accounts);
    $this->assertFalse($new_user->status, 'New account is blocked until approved by an administrator.');
  }

  function testRegistrationWithoutEmailVerification() {
    $config = config('system.core');

    // Don't require email verification.
    $config->set('user_email_verification', FALSE)->save();

    // Allow registration by site visitors without administrator approval.
    $config->set('user_register', USER_REGISTER_VISITORS)->save();
    $edit = array();
    $edit['name'] = $name = $this->randomName();
    $edit['mail'] = $mail = $edit['name'] . '@example.com';
    $edit['pass'] = $new_pass = $this->randomName();
    $this->backdropPost('user/register', $edit, t('Create new account'));
    $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));
    $new_user = reset($accounts);
    $this->assertText(t('Registration successful. You are now logged in.'), 'Users are logged in after registering.');
    $this->backdropLogout();

    // Allow registration by site visitors, but require administrator approval.
    $config->set('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL)->save();
    $edit = array();
    $edit['name'] = $name = $this->randomName();
    $edit['mail'] = $mail = $edit['name'] . '@example.com';
    $edit['pass'] = $pass = $this->randomName();
    $this->backdropPost('user/register', $edit, t('Create new account'));
    $this->assertText(t('Thank you for applying for an account. Your account is currently pending approval by the site administrator.'), 'Users are notified of pending approval');

    // Try to login before administrator approval.
    $auth = array(
      'name' => $name,
      'pass' => $pass,
    );
    $this->backdropPost('user/login', $auth, t('Log in'));
    $this->assertText(t('The account for @name has not been activated or is blocked.', array('@name' => $name)), 'User cannot login yet.');

    // Activate the new account.
    $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));
    $new_user = reset($accounts);
    $admin_user = $this->backdropCreateUser(array('administer users'));
    $this->backdropLogin($admin_user);
    $edit = array(
      'status' => 1,
    );
    $this->backdropPost('user/' . $new_user->uid . '/edit', $edit, t('Save'));
    $this->backdropLogout();

    // Login after administrator approval.
    $this->backdropPost('user/login', $auth, t('Log in'));
    $this->assertText(t('Member for'), 'User can log in after administrator approval.');
  }

  function testRegistrationEmailDuplicates() {
    $config = config('system.core');

    // Don't require email verification.
    $config->set('user_email_verification', FALSE)->save();

    // Allow registration by site visitors without administrator approval.
    $config->set('user_register', USER_REGISTER_VISITORS)->save();

    // Set up a user to check for duplicates.
    $duplicate_user = $this->backdropCreateUser();

    $edit = array();
    $edit['name'] = $this->randomName();
    $edit['mail'] = $duplicate_user->mail;

    // Attempt to create a new account using an existing email address.
    $this->backdropPost('user/register', $edit, t('Create new account'));
    $this->assertRaw(t('The email address %email is already registered.', array('%email' => $duplicate_user->mail)), 'Supplying an exact duplicate email address displays an error message');

    // Attempt to bypass duplicate email registration validation by adding spaces.
    $edit['mail'] = '   ' . $duplicate_user->mail . '   ';

    $this->backdropPost('user/register', $edit, t('Create new account'));
    $this->assertRaw(t('The email address %email is already registered.', array('%email' => $duplicate_user->mail)), 'Supplying a duplicate email address with added whitespace displays an error message');
  }

  function testRegistrationDefaultValues() {
    $config_user_settings = config('system.core');

    // Allow registration by site visitors without administrator approval.
    $config_user_settings->set('user_register', USER_REGISTER_VISITORS)->save();

    // Don't require email verification.
    $config_user_settings->set('user_email_verification', FALSE)->save();

    // Set the default timezone to Brussels.
    $config_system_date = config('system.date')
      ->set('user_configurable_timezones', 1)
      ->set('default_timezone', 'Europe/Brussels')
      ->save();

    // Check that the account information fieldset's options are not displayed
    // is a fieldset if there is not more than one fieldset in the form.
    $this->backdropGet('user/register');
    $this->assertNoRaw('<fieldset id="edit-account"><legend>Account information</legend>', 'Account settings fieldset was hidden.');

    $edit = array();
    $edit['name'] = $name = $this->randomName();
    $edit['mail'] = $mail = $edit['name'] . '@example.com';
    $edit['pass'] = $new_pass = $this->randomName();
    $this->backdropPost(NULL, $edit, t('Create new account'));

    // Check user fields.
    $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));
    $new_user = reset($accounts);
    $this->assertEqual($new_user->name, $name, 'Username matches.');
    $this->assertEqual($new_user->mail, $mail, 'Email address matches.');
    $this->assertEqual($new_user->signature, '', 'Correct signature field.');
    $this->assertTrue(($new_user->created > REQUEST_TIME - 20 ), 'Correct creation time.');
    $this->assertEqual($new_user->changed, $new_user->created, 'Correct changed time.');
    $this->assertEqual($new_user->status, $config_user_settings->get('user_register') == USER_REGISTER_VISITORS ? 1 : 0, 'Correct status field.');
    $this->assertEqual($new_user->timezone, $config_system_date->get('default_timezone'), 'Correct time zone field.');
    $this->assertEqual($new_user->language, '', 'Correct language field.');
    $this->assertEqual($new_user->picture, 0, 'Correct picture field.');
    $this->assertEqual($new_user->init, $mail, 'Correct init field.');
  }

  /**
   * Tests Field API fields on user registration forms.
   */
  function testRegistrationWithUserFields() {
    module_enable(array('field', 'field_test'));
    $config_user_settings = config('system.core');

    // Create a field, and an instance on 'user' entity type.
    $field = array(
      'type' => 'test_field',
      'field_name' => 'test_user_field',
      'cardinality' => 1,
    );
    field_create_field($field);
    $instance = array(
      'field_name' => 'test_user_field',
      'entity_type' => 'user',
      'label' => 'Some user field',
      'bundle' => 'user',
      'required' => TRUE,
      'settings' => array('user_register_form' => FALSE),
    );
    field_create_instance($instance);

    // Check that the field does not appear on the registration form.
    $config_user_settings->set('user_register', USER_REGISTER_VISITORS)->save();
    $this->backdropGet('user/register');
    $this->assertNoText($instance['label'], 'The field does not appear on user registration form');

    // Have the field appear on the registration form.
    $instance['settings']['user_register_form'] = TRUE;
    field_update_instance($instance);
    $this->backdropGet('user/register');
    $this->assertText($instance['label'], 'The field appears on user registration form');

    // Check that validation errors are correctly reported.
    $edit = array();
    $edit['name'] = $name = $this->randomName();
    $edit['mail'] = $mail = $edit['name'] . '@example.com';
    // Missing input in required field.
    $edit['test_user_field[und][0][value]'] = '';
    $this->backdropPost(NULL, $edit, t('Create new account'));
    $this->assertRaw(t('@name field is required.', array('@name' => $instance['label'])), 'Field validation error was correctly reported.');
    // Invalid input.
    $edit['test_user_field[und][0][value]'] = '-1';
    $this->backdropPost(NULL, $edit, t('Create new account'));
    $this->assertRaw(t('%name does not accept the value -1.', array('%name' => $instance['label'])), 'Field validation error was correctly reported.');

    // Submit with valid data.
    $value = rand(1, 255);
    $edit['test_user_field[und][0][value]'] = $value;
    $this->backdropPost(NULL, $edit, t('Create new account'));
    // Check user fields.
    $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));
    $new_user = reset($accounts);
    $this->assertEqual($new_user->test_user_field[LANGUAGE_NONE][0]['value'], $value, 'The field value was correctly saved.');

    // Check that the 'add more' button works.
    $field['cardinality'] = FIELD_CARDINALITY_UNLIMITED;
    field_update_field($field);
    foreach (array('js', 'nojs') as $js) {
      $this->backdropGet('user/register');
      // Add two inputs.
      $value = rand(1, 255);
      $edit = array();
      $edit['test_user_field[und][0][value]'] = $value;
      if ($js == 'js') {
        $this->backdropPostAJAX(NULL, $edit, 'test_user_field_add_more');
        $this->backdropPostAJAX(NULL, $edit, 'test_user_field_add_more');
      }
      else {
        $this->backdropPost(NULL, $edit, t('Add another'));
        $this->backdropPost(NULL, $edit, t('Add another'));
      }
      // Submit with three values.
      $edit['test_user_field[und][1][value]'] = $value + 1;
      $edit['test_user_field[und][2][value]'] = $value + 2;
      $edit['name'] = $name = $this->randomName();
      $edit['mail'] = $mail = $edit['name'] . '@example.com';
      $this->backdropPost(NULL, $edit, t('Create new account'));
      // Check user fields.
      $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));
      $new_user = reset($accounts);
      $this->assertEqual($new_user->test_user_field[LANGUAGE_NONE][0]['value'], $value, format_string('@js : The field value was correctly saved.', array('@js' => $js)));
      $this->assertEqual($new_user->test_user_field[LANGUAGE_NONE][1]['value'], $value + 1, format_string('@js : The field value was correctly saved.', array('@js' => $js)));
      $this->assertEqual($new_user->test_user_field[LANGUAGE_NONE][2]['value'], $value + 2, format_string('@js : The field value was correctly saved.', array('@js' => $js)));
    }
  }

  /**
   * Tests new users username matches their email if username is an email.
   */
  function testRegistrationEmailAsUsername() {
    // Don't require email verification.
    // Allow registration by site visitors without administrator approval.
    config('system.core')
      ->set('user_email_verification', FALSE)
      ->set('user_register', USER_REGISTER_VISITORS)
      ->save();

    $mail = $this->randomName() . '@example.com';
    $different = $this->randomName() . $mail;

    // Set up edit array.
    $edit = array();
    $edit['mail'] = $mail;
    $edit['name'] = $different;
    $edit['pass'] = $this->randomName();

    // Attempt to create an account using an email that doesn't match the name.
    $this->backdropPost('user/register', $edit, t('Create new account'));
    $this->assertText(t('An email address was provided as a username, but does not match the account email address.'), 'Email username does not match user email - error message found.');
    $this->assertNoText(t('Registration successful. You are now logged in.'), 'The user was not created and logged in.');

    // Attempt to create new account using matching email address.
    $edit['name'] = $edit['mail'] = $this->randomName() . '@example.com';

    $this->backdropPost('user/register', $edit, t('Create new account'));
    $this->assertText(t('Registration successful. You are now logged in.'), 'The user was created and logged in with matching email.');

    $new_user = user_load_by_name($edit['name']);
    $this->assertTrue(($new_user->name === $edit['name']) && ($new_user->mail === $edit['mail']), 'Created user with matching username and email address.');
  }

  /**
   * Tests new users username not matching their email if username is an email.
   */
  function testRegistrationEmailAsUsernameDisabled() {
    // Test that 'user_email_match' turned off allows emails that don't match.
    config('system.core')
      ->set('user_email_match', FALSE)
      ->set('user_email_verification', FALSE)
      ->set('user_register', USER_REGISTER_VISITORS)
      ->save();

    $mail = $this->randomName() . '@example.com';
    $different = $this->randomName() . $mail;

    $edit = array();
    $edit['mail'] = $mail;
    $edit['name'] = $different;
    $edit['pass'] = $this->randomName();

    // Attempt to create an account using an email that doesn't match the name.
    // This should be OK, as 'user_email_match' is disabled.
    $this->backdropPost('user/register', $edit, t('Create new account'));
    $this->assertNoText(t('An email address was provided as a username, but does not match the account email address.'), 'Email username does not match user email - error message found.');
    $this->assertText(t('Registration successful. You are now logged in.'), 'The user was not created and logged in.');
  }
}

class UserValidationTestCase extends BackdropUnitTestCase {
  // Username validation.
  function testUsernames() {
    $test_cases = array( // '<username>' => array('<description>', 'assert<testName>'),
      'foo'                    => array('Valid username', 'assertNull'),
      'FOO'                    => array('Valid username', 'assertNull'),
      'Foo O\'Bar'             => array('Valid username', 'assertNull'),
      'foo@bar'                => array('Valid username', 'assertNull'),
      'foo@example.com'        => array('Valid username', 'assertNull'),
      // Invalid domains are allowed in usernames.
      'foo@-example.com'       => array('Valid username', 'assertNull'),
      // cspell:disable
      'þòøÇߪř€'               => array('Valid username', 'assertNull'),
      // Runes.
      'ᚠᛇᚻ᛫ᛒᛦᚦ'                 => array('Valid UTF8 username', 'assertNull'),
      // cspell:enable
      // '+' symbol is allowed.
      'foo+bar'                => array('Valid username', 'assertNull'),
      ' foo'                   => array('Invalid username that starts with a space', 'assertNotNull'),
      'foo '                   => array('Invalid username that ends with a space', 'assertNotNull'),
      'foo  bar'               => array('Invalid username that contains 2 spaces \'&nbsp;&nbsp;\'', 'assertNotNull'),
      ''                       => array('Invalid empty username', 'assertNotNull'),
      'foo/'                   => array('Invalid username containing invalid chars', 'assertNotNull'),
      // NULL.
      'foo' . chr(0) . 'bar'   => array('Invalid username containing chr(0)', 'assertNotNull'),
      // CR.
      'foo' . chr(13) . 'bar'  => array('Invalid username containing chr(13)', 'assertNotNull'),
      str_repeat('x', USERNAME_MAX_LENGTH + 1) => array('Invalid excessively long username', 'assertNotNull'),
    );
    foreach ($test_cases as $name => $test_case) {
      list($description, $test) = $test_case;
      $result = user_validate_name($name);
      $this->$test($result, $description . ' (' . $name . ')');
    }
  }
}

/**
 * Functional tests for user logins, including rate limiting of login attempts.
 */
class UserLoginTestCase extends UserLoginTestBase {
  protected $profile = 'testing';

  function setUp() {
    parent::setUp('user_session_test');
  }

  /**
   * Test that login credentials work (or not) in different login modes.
   */
  function testLoginMethods() {
    $account = $this->backdropCreateUser(array());

    // Login via name or email (both succeed). The default for new sites.
    config_set('system.core', 'user_login_method', USER_LOGIN_USERNAME_OR_EMAIL);
    $this->backdropLogin($account, TRUE);
    $this->backdropLogin($account);

    // Login via email only.
    config_set('system.core', 'user_login_method', USER_LOGIN_EMAIL_ONLY);
    $this->backdropLogin($account, TRUE);
    // Fail login via name.
    $this->assertFailedLogin($account);

    // Login via name.
    config_set('system.core', 'user_login_method', USER_LOGIN_USERNAME_ONLY);
    $this->backdropLogin($account);
    // Fail login via email.
    $this->assertFailedLogin($account, TRUE);

    // Test login when no user_login_method is set. Allows for logging in for
    // users that are upgrading their site for the first time to support login
    // by username.
    config_set('system.core', 'user_login_method', NULL);
    $this->backdropLogin($account);
    // Fail login via email.
    $this->assertFailedLogin($account, TRUE);
  }

  /**
   * Test the global login flood control.
   */
  function testGlobalLoginFloodControl() {
    config('user.flood')
      ->set('flood_ip_limit', 10)
      // Set a high per-user limit out so that it is not relevant in the test.
      ->set('flood_user_limit', 4000)
      ->save();

    $user1 = $this->backdropCreateUser(array());
    $incorrect_user1 = clone $user1;
    $incorrect_user1->pass_raw .= 'incorrect';

    // Try 2 failed logins.
    for ($i = 0; $i < 2; $i++) {
      $this->assertFailedLogin($incorrect_user1, NULL, TRUE);
    }

    // A successful login will not reset the IP-based flood control count.
    $this->backdropLogin($user1);
    $this->backdropLogout();

    // Try 8 more failed logins, they should not trigger the flood control
    // mechanism.
    for ($i = 0; $i < 8; $i++) {
      $this->assertFailedLogin($incorrect_user1, NULL, TRUE);
    }

    // The next login trial should result in an IP-based flood error message.
    $this->assertFailedLogin($incorrect_user1, NULL, TRUE, 'ip');

    // A login with the correct password should also result in a flood error
    // message.
    $this->assertFailedLogin($user1, NULL, TRUE, 'ip');

    // A login attempt after resetting the password should still fail, since the
    // IP-based flood control count is not cleared after a password reset.
    $new_pass = $this->resetUserPassword($user1);
    $user1->pass_raw = $new_pass;
    $this->backdropLogout();
    $this->assertFailedLogin($user1, NULL, FALSE, 'ip');
    $this->assertRaw(t('Sorry, too many failed login attempts from your IP address. This IP address is temporarily blocked. Try again later or <a href="@url">request a new password</a>.', array('@url' => url('user/password'))));
  }

  /**
   * Test the per-user login flood control.
   */
  function testPerUserLoginFloodControl() {
    config('user.flood')
      // Set a high global limit out so that it is not relevant in the test.
      ->set('flood_ip_limit', 4000)
      ->set('flood_user_limit', 3)
      ->save();

    $user1 = $this->backdropCreateUser(array());
    $incorrect_user1 = clone $user1;
    $incorrect_user1->pass_raw .= 'incorrect';

    $user2 = $this->backdropCreateUser(array());

    // Try 2 failed logins.
    for ($i = 0; $i < 2; $i++) {
      $this->assertFailedLogin($incorrect_user1, NULL, TRUE);
    }

    // A successful login will reset the per-user flood control count.
    $this->backdropLogin($user1);
    $this->backdropLogout();

    // Try 3 failed logins for user 1, they will not trigger flood control.
    for ($i = 0; $i < 3; $i++) {
      $this->assertFailedLogin($incorrect_user1, NULL, TRUE);
    }

    // Try one successful attempt for user 2, it should not trigger any
    // flood control.
    $this->backdropLogin($user2);
    $this->backdropLogout();

    // Try one more attempt for user 1, it should be rejected, even if the
    // correct password has been used.
    $this->assertFailedLogin($user1, NULL, TRUE, 'user');

    // Resetting the password should clear the flood control for the user.
    $new_pass = $this->resetUserPassword($user1);
    $this->backdropLogout();

    // Try to log in as user 1, it should be successful.
    // Need to reload user since the password changed.
    $user1->pass_raw = $new_pass;
    $this->backdropLogin($user1);
    $this->assertRaw('Member for');

  }

  /**
   * Test that user password is re-hashed upon login after changing $count_log2.
   */
  function testPasswordRehashOnLogin() {
    // Load password hashing API.
    require_once BACKDROP_ROOT . '/' . settings_get('password_inc', 'core/includes/password.inc');
    // Set initial $count_log2 to the default, BACKDROP_HASH_COUNT.
    $GLOBALS['settings']['password_count_log2'] = BACKDROP_HASH_COUNT;
    tempstore_set('simpletest', 'settings', array(
      'password_count_log2' => BACKDROP_HASH_COUNT,
    ), REQUEST_TIME + 3600);

    // Create a new user and authenticate.
    $account = $this->backdropCreateUser(array());
    $password = $account->pass_raw;
    $this->backdropLogin($account);
    $this->backdropLogout();
    // Load the stored user. The password hash should reflect $count_log2.
    $account = user_load($account->uid);
    $this->assertIdentical(_password_get_count_log2($account->pass), BACKDROP_HASH_COUNT);
    // Change $count_log2 and log in again.
    tempstore_set('simpletest', 'settings', array(
      'password_count_log2' => BACKDROP_HASH_COUNT + 1,
    ), REQUEST_TIME + 3600);

    $account->pass_raw = $password;
    $this->backdropLogin($account);
    // Load the stored user, which should have a different password hash now.
    $account = user_load($account->uid, TRUE);
    $this->assertIdentical(_password_get_count_log2($account->pass), BACKDROP_HASH_COUNT + 1);
  }

  /**
   * Test logging in when an anon session already exists.
   */
  function testLoginWithAnonSession() {
    // Visit the callback to generate a session for this anon user.
    $this->backdropGet('user_session_test_anon_session');
    // Now login.
    $account = $this->backdropCreateUser(array());
    $this->backdropLogin($account);
  }

  /**
   * Attempt to login with an unregistered username.
   */
  function testAccountNotFound() {
    $edit = array(
      'name' => $this->randomName(8),
      'pass' => $this->randomName(8),
    );
    $this->backdropPost('user', $edit, t('Log in'));
    $this->assertText(t('Sorry, unrecognized username.'));
  }

  /**
   * Attempt to login with an invalid array users and passwords.
   */
  function testArrayLoginValues() {
    $edit = array(
      'pass' => $this->randomName(8),
    );
    $extra_post = '&' . http_build_query(array(
      'name[0]' => $this->randomName(8),
      'name[1]' => $this->randomName(8),
    ));
    $this->backdropPost('user', $edit, t('Log in'), array(), array(), NULL, $extra_post);
    $this->assertText(t('Sorry, unrecognized username.'));

    $account = $this->backdropCreateUser(array());
    $edit = array(
      'name' => $account->name,
    );
    $extra_post = '&' . http_build_query(array(
      'pass[0]' => $this->randomName(8),
      'pass[1]' => $this->randomName(8),
    ));
    $this->backdropPost('user', $edit, t('Log in'), array(), array(), NULL, $extra_post);
    $this->assertText(t('Sorry, incorrect password.'));
  }

  /**
   * Resets the user password and logs the user in.
   *
   * @param User $user
   *   The account to reset the password for.
   * @return string
   *   New password.
   */
  protected function resetUserPassword(User $user) {
    $this->backdropGet('user/password');
    $edit['name'] = $user->name;
    $this->backdropPost(NULL, $edit, 'Reset password');
    $emails = $this->backdropGetMails();
    $email = end($emails);
    $urls = array();
    preg_match('#.+user/reset/.+#', $email['body'], $urls);
    $resetURL = $urls[0];
    $this->backdropGet($resetURL);
    $pass = user_password();
    $pass_edit = array(
      'pass[pass1]' => $pass,
      'pass[pass2]' => $pass,
    );
    $this->backdropPost(NULL, $pass_edit, t('Save password & log in'));

    return $pass;
  }

}

/**
 * Test cancelling a user.
 */
class UserCancelTestCase extends BackdropWebTestCase {

  /**
   * @var User
   */
  protected $admin_user;

  /**
   * Attempt to cancel account without permission.
   */
  function testUserCancelWithoutPermission() {
    config_set('system.core', 'user_cancel_method', 'user_cancel_reassign');

    // Create a user.
    $account = $this->backdropCreateUser(array());
    $this->backdropLogin($account);
    // Load real user object.
    $account = user_load($account->uid, TRUE);

    // Create a node.
    $node = $this->backdropCreateNode(array('uid' => $account->uid));

    // Attempt to cancel account.
    $this->backdropGet('user/' . $account->uid . '/edit');
    $this->assertNoRaw(t('Cancel account'), 'No cancel account button displayed.');

    // Attempt bogus account cancellation request confirmation.
    $timestamp = $account->login;
    $this->backdropGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid, $account->mail));
    $this->assertResponse(403, 'Bogus cancelling request rejected.');
    $account = user_load($account->uid);
    $this->assertTrue($account->status == 1, 'User account was not canceled.');

    // Confirm user's content has not been altered.
    $test_node = node_load($node->nid, NULL, TRUE);
    $this->assertTrue(($test_node->uid == $account->uid && $test_node->status == 1), 'Node of the user has not been altered.');
  }

  /**
   * Tests that user account for uid 1 cannot be cancelled.
   *
   * This should never be possible, or the site owner would become unable to
   * administer the site.
   */
  function testUserCancelUid1() {
    // Update uid 1's name and password to we know it.
    $password = user_password();
    require_once BACKDROP_ROOT . '/' . settings_get('password_inc', 'core/includes/password.inc');
    $account = array(
      'name' => 'user1',
      'pass' => user_hash_password(trim($password)),
    );
    // We cannot use $account->save() here, because this would result in the
    // password being hashed again.
    db_update('users')
      ->fields($account)
      ->condition('uid', 1)
      ->execute();

    // Reload and log in uid 1.
    $user1 = user_load(1, TRUE);
    $user1->pass_raw = $password;

    // Try to cancel uid 1's account with a different user.
    $this->admin_user = $this->backdropCreateUser(array('administer users'));
    $this->backdropLogin($this->admin_user);
    $edit = array(
      'action' => 'user_cancel_user_action',
      'bulk_form[0]' => TRUE,
    );
    $this->backdropPost('admin/people', $edit, t('Execute'));

    // Verify that uid 1's account was not cancelled.
    $user1 = user_load(1, TRUE);
    $this->assertEqual($user1->status, 1, 'User #1 still exists and is not blocked.');
  }

  /**
   * Attempt invalid account cancellations.
   */
  function testUserCancelInvalid() {
    config_set('system.core', 'user_cancel_method', 'user_cancel_reassign');

    // Create a user.
    $account = $this->backdropCreateUser(array('cancel account'));
    $this->backdropLogin($account);
    // Load real user object.
    $account = user_load($account->uid, TRUE);

    // Create a node.
    $node = $this->backdropCreateNode(array('uid' => $account->uid));

    // Attempt to cancel account.
    $this->backdropPost('user/' . $account->uid . '/edit', NULL, t('Cancel account'));

    // Confirm account cancellation.
    $timestamp = time();
    $this->backdropPost(NULL, NULL, t('Cancel account'));
    $this->assertText(t('A confirmation request to cancel your account has been sent to your email address.'), 'Account cancellation request mailed message displayed.');

    // Attempt bogus account cancellation request confirmation.
    $bogus_timestamp = $timestamp + 60;
    $this->backdropGet("user/$account->uid/cancel/confirm/$bogus_timestamp/" . user_pass_rehash($account->pass, $bogus_timestamp, $account->login, $account->uid, $account->mail));
    $this->assertText(t('You have tried to use an account cancellation link that has expired. Please request a new one using the form below.'), 'Bogus cancelling request rejected.');
    $account = user_load($account->uid);
    $this->assertTrue($account->status == 1, 'User account was not canceled.');

    // Attempt expired account cancellation request confirmation.
    $bogus_timestamp = $timestamp - 86400 - 60;
    $this->backdropGet("user/$account->uid/cancel/confirm/$bogus_timestamp/" . user_pass_rehash($account->pass, $bogus_timestamp, $account->login, $account->uid, $account->mail));
    $this->assertText(t('You have tried to use an account cancellation link that has expired. Please request a new one using the form below.'), 'Expired cancel account request rejected.');
    $accounts = user_load_multiple(array($account->uid), array('status' => 1));
    $this->assertTrue(reset($accounts), 'User account was not canceled.');

    // Confirm user's content has not been altered.
    $test_node = node_load($node->nid, NULL, TRUE);
    $this->assertTrue(($test_node->uid == $account->uid && $test_node->status == 1), 'Node of the user has not been altered.');
  }

  /**
   * Disable account and keep all content.
   */
  function testUserBlock() {
    config_set('system.core', 'user_cancel_method', 'user_cancel_block');

    // Create a user.
    $web_user = $this->backdropCreateUser(array('cancel account'));
    $this->backdropLogin($web_user);

    // Load real user object.
    $account = user_load($web_user->uid, TRUE);

    // Attempt to cancel account.
    $this->backdropGet('user/' . $account->uid . '/edit');
    $this->backdropPost(NULL, NULL, t('Cancel account'));
    $this->assertText(t('Are you sure you want to cancel your account?'), 'Confirmation form to cancel account displayed.');
    $this->assertText(t('Your account will be blocked and you will no longer be able to log in. All of your content will remain attributed to your user name.'), 'Informs that all content will be remain as is.');
    $this->assertNoText(t('Select the method to cancel the account above.'), 'Does not allow user to select account cancellation method.');

    // Confirm account cancellation.
    $timestamp = time();

    $this->backdropPost(NULL, NULL, t('Cancel account'));
    $this->assertText(t('A confirmation request to cancel your account has been sent to your email address.'), 'Account cancellation request mailed message displayed.');

    // Confirm account cancellation request.
    $this->backdropGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid, $account->mail));
    $account = user_load($account->uid, TRUE);
    $this->assertTrue($account->status == 0, 'User has been blocked.');

    // Confirm that the confirmation message made it through to the end user.
    $this->assertRaw(t('%name has been disabled.', array('%name' => $account->name)), 'Confirmation message displayed to user.');
  }

  /**
   * Disable account and unpublish all content.
   */
  function testUserBlockUnpublish() {
    config_set('system.core', 'user_cancel_method', 'user_cancel_block_unpublish');

    // Create a user.
    $account = $this->backdropCreateUser(array('cancel account'));
    $this->backdropLogin($account);
    // Load real user object.
    $account = user_load($account->uid, TRUE);

    // Create a node with two revisions.
    $node = $this->backdropCreateNode(array('uid' => $account->uid));
    $settings = get_object_vars($node);
    $settings['revision'] = 1;
    $node = $this->backdropCreateNode($settings);

    // Attempt to cancel account.
    $this->backdropGet('user/' . $account->uid . '/edit');
    $this->backdropPost(NULL, NULL, t('Cancel account'));
    $this->assertText(t('Are you sure you want to cancel your account?'), 'Confirmation form to cancel account displayed.');
    $this->assertText(t('Your account will be blocked and you will no longer be able to log in. All of your content will be hidden from everyone but administrators.'), 'Informs that all content will be unpublished.');

    // Confirm account cancellation.
    $timestamp = time();
    $this->backdropPost(NULL, NULL, t('Cancel account'));
    $this->assertText(t('A confirmation request to cancel your account has been sent to your email address.'), 'Account cancellation request mailed message displayed.');

    // Confirm account cancellation request.
    $this->backdropGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid, $account->mail));
    $account = user_load($account->uid, TRUE);
    $this->assertTrue($account->status == 0, 'User has been blocked.');

    // Confirm user's content has been unpublished.
    $test_node = node_load($node->nid, NULL, TRUE);
    $this->assertTrue($test_node->status == 0, 'Node of the user has been unpublished.');
    $test_node = node_load($node->nid, $node->vid, TRUE);
    $this->assertTrue($test_node->status == 0, 'Node revision of the user has been unpublished.');

    // Confirm that the confirmation message made it through to the end user.
    $this->assertRaw(t('%name has been disabled.', array('%name' => $account->name)), 'Confirmation message displayed to user.');
  }

  /**
   * Delete account and anonymize all content.
   */
  function testUserAnonymize() {
    config_set('system.core', 'user_cancel_method', 'user_cancel_reassign');

    // Create a user.
    $account = $this->backdropCreateUser(array('cancel account'));
    $this->backdropLogin($account);
    // Load real user object.
    $account = user_load($account->uid, TRUE);

    // Create a simple node.
    $node = $this->backdropCreateNode(array('uid' => $account->uid));

    // Create a node with two revisions, the initial one belonging to the
    // cancelling user.
    $revision_node = $this->backdropCreateNode(array('uid' => $account->uid));
    $revision = $revision_node->vid;
    $settings = get_object_vars($revision_node);
    $settings['revision'] = 1;
    $settings['uid'] = 1; // Set new/current revision to someone else.
    $revision_node = $this->backdropCreateNode($settings);

    // Attempt to cancel account.
    $this->backdropGet('user/' . $account->uid . '/edit');
    $this->backdropPost(NULL, NULL, t('Cancel account'));
    $this->assertText(t('Are you sure you want to cancel your account?'), 'Confirmation form to cancel account displayed.');
    $this->assertRaw(t('Your account will be removed and all account information deleted. All of your content will be assigned to the %anonymous-name user.', array('%anonymous-name' => config_get('system.core', 'anonymous'))), 'Informs that all content will be attributed to anonymous account.');

    // Confirm account cancellation.
    $timestamp = time();
    $this->backdropPost(NULL, NULL, t('Cancel account'));
    $this->assertText(t('A confirmation request to cancel your account has been sent to your email address.'), 'Account cancellation request mailed message displayed.');

    // Confirm account cancellation request.
    $this->backdropGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid, $account->mail));
    $this->assertFalse(user_load($account->uid, TRUE), 'User is not found in the database.');

    // Confirm that user's content has been attributed to anonymous user.
    $test_node = node_load($node->nid, NULL, TRUE);
    $this->assertTrue(($test_node->uid == 0 && $test_node->status == 1), 'Node of the user has been attributed to anonymous user.');
    $test_node = node_load($revision_node->nid, $revision, TRUE);
    $this->assertTrue(($test_node->revision_uid == 0 && $test_node->status == 1), 'Node revision of the user has been attributed to anonymous user.');
    $test_node = node_load($revision_node->nid, NULL, TRUE);
    $this->assertTrue(($test_node->uid != 0 && $test_node->status == 1), "Current revision of the user's node was not attributed to anonymous user.");

    // Confirm that the confirmation message made it through to the end user.
    $this->assertRaw(t('%name has been deleted.', array('%name' => $account->name)), 'Confirmation message displayed to user.');
  }

  /**
   * Delete account and remove all content.
   */
  function testUserDelete() {
    config_set('system.core', 'user_cancel_method', 'user_cancel_delete');

    // Create a user.
    $account = $this->backdropCreateUser(array('cancel account', 'post comments', 'skip comment approval'));
    $this->backdropLogin($account);
    // Load real user object.
    $account = user_load($account->uid, TRUE);

    // Enable comment subjects on 'page' nodes
    $node_type = node_type_get_type('page');
    $node_type->settings['comment_title_options'] = COMMENT_TITLE_CUSTOM;
    node_type_save($node_type);

    // Create a simple node.
    $node = $this->backdropCreateNode(array('uid' => $account->uid));

    // Create comment.
    $langcode = LANGUAGE_NONE;
    $edit = array();
    $edit['subject'] = $this->randomName(8);
    $edit['comment_body[' . $langcode . '][0][value]'] = $this->randomName(16);

    $this->backdropPost('comment/reply/' . $node->nid, $edit, t('Preview'));
    $this->backdropPost(NULL, array(), t('Save'));
    $this->assertText(t('Your comment has been posted.'));
    $comments = comment_load_multiple(FALSE, array('subject' => $edit['subject']));
    $comment = reset($comments);
    $this->assertTrue($comment->cid, 'Comment found.');

    // Create a node with two revisions, the initial one belonging to the
    // cancelling user.
    $revision_node = $this->backdropCreateNode(array('uid' => $account->uid));
    $revision = $revision_node->vid;
    $settings = get_object_vars($revision_node);
    $settings['revision'] = 1;
    $settings['uid'] = 1; // Set new/current revision to someone else.
    $revision_node = $this->backdropCreateNode($settings);

    // Attempt to cancel account.
    $this->backdropGet('user/' . $account->uid . '/edit');
    $this->backdropPost(NULL, NULL, t('Cancel account'));
    $this->assertText(t('Are you sure you want to cancel your account?'), 'Confirmation form to cancel account displayed.');
    $this->assertText(t('Your account will be removed and all account information deleted. All of your content will also be deleted.'), 'Informs that all content will be deleted.');

    // Confirm account cancellation.
    $timestamp = time();
    $this->backdropPost(NULL, NULL, t('Cancel account'));
    $this->assertText(t('A confirmation request to cancel your account has been sent to your email address.'), 'Account cancellation request mailed message displayed.');

    // Confirm account cancellation request.
    $this->backdropGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid, $account->mail));
    $this->assertFalse(user_load($account->uid, TRUE), 'User is not found in the database.');

    // Confirm that user's content has been deleted.
    $this->assertFalse(node_load($node->nid, NULL, TRUE), 'Node of the user has been deleted.');
    $this->assertFalse(node_load($node->nid, $revision, TRUE), 'Node revision of the user has been deleted.');
    $this->assertTrue(node_load($revision_node->nid, NULL, TRUE), "Current revision of the user's node was not deleted.");
    $this->assertFalse(comment_load($comment->cid), 'Comment of the user has been deleted.');

    // Confirm that the confirmation message made it through to the end user.
    $this->assertRaw(t('%name has been deleted.', array('%name' => $account->name)), 'Confirmation message displayed to user.');
  }

  /**
   * Create an administrative user and delete another user.
   */
  function testUserCancelByAdmin() {
    config_set('system.core', 'user_cancel_method', 'user_cancel_reassign');

    // Create a regular user.
    $account = $this->backdropCreateUser(array());

    // Create administrative user.
    $admin_user = $this->backdropCreateUser(array('administer users'));
    $this->backdropLogin($admin_user);

    // Delete regular user.
    $this->backdropGet('user/' . $account->uid . '/edit');
    $this->backdropPost(NULL, NULL, t('Cancel account'));
    $this->assertRaw(t('Are you sure you want to cancel the account %name?', array('%name' => $account->name)), 'Confirmation form to cancel account displayed.');
    $this->assertText(t('Select the method to cancel the account above.'), 'Allows to select account cancellation method.');

    // Confirm deletion.
    $this->backdropPost(NULL, NULL, t('Cancel account'));
    $this->assertRaw(t('%name has been deleted.', array('%name' => $account->name)), 'User deleted.');
    $this->assertFalse(user_load($account->uid), 'User is not found in the database.');
  }

  /**
   * Create an administrative user and mass-delete other users.
   */
  function testMassUserCancelByAdmin() {
    config_set('system.core', 'user_cancel_method', 'user_cancel_reassign');
    // Enable account cancellation notification.
    config_set('system.core', 'user_mail_status_canceled_notify', TRUE);

    // Create administrative user.
    $admin_user = $this->backdropCreateUser(array('administer users'));
    $this->backdropLogin($admin_user);

    // Create some users.
    $users = array();
    for ($i = 0; $i < 3; $i++) {
      $account = $this->backdropCreateUser(array());
      $users[$account->uid] = $account;
    }

    // Cancel user accounts, including own one.
    $edit = array();
    $edit['action'] = 'user_cancel_user_action';
    $edit['bulk_form[0]'] = TRUE; // Try to cancel uid 1.
    $edit['bulk_form[1]'] = TRUE; // Cancel the created admin user.
    $position = 1;
    foreach ($users as $account) {
      $position++;
      $edit['bulk_form[' . $position . ']'] = TRUE;
    }
    $this->backdropPost('admin/people', $edit, t('Execute'));
    $this->assertText(t('Are you sure you want to cancel these user accounts?'), 'Confirmation form to cancel accounts displayed.');
    $this->assertText(t('When cancelling these accounts'), 'Allows to select account cancellation method.');
    $this->assertText(t('Require email confirmation to cancel account.'), 'Allows to send confirmation mail.');
    $this->assertText(t('Notify user when account is canceled.'), 'Allows to send notification mail.');

    // Confirm deletion.
    $this->backdropPost(NULL, NULL, t('Cancel accounts'));
    $status = TRUE;
    foreach ($users as $account) {
      $status = $status && (strpos($this->content, t('%name has been deleted.', array('%name' => $account->name))) !== FALSE);
      $status = $status && !user_load($account->uid, TRUE);
    }
    $this->assertTrue($status, 'Users deleted and not found in the database.');

    // Ensure that admin account was not cancelled.
    $this->assertText(t('A confirmation request to cancel your account has been sent to your email address.'), 'Account cancellation request mailed message displayed.');
    $admin_user = user_load($admin_user->uid);
    $this->assertTrue($admin_user->status == 1, 'Administrative user is found in the database and enabled.');

    // Verify that uid 1's account was not cancelled.
    $user1 = user_load(1, TRUE);
    $this->assertEqual($user1->status, 1, 'User #1 still exists and is not blocked.');
  }
}

class UserPictureTestCase extends BackdropWebTestCase {
  protected $profile = 'minimal';
  protected $user;
  protected $_directory_test;

  function setUp() {
    parent::setUp(array('image'));

    // Enable user pictures.
    config_set('system.core', 'user_pictures', 1);

    $this->user = $this->backdropCreateUser();

    // Test if directories specified in settings exist in filesystem.
    $file_dir = 'public://';
    $file_check = file_prepare_directory($file_dir, FILE_CREATE_DIRECTORY);
    // TODO: Test public and private methods?

    $picture_dir = config_get('system.core', 'user_picture_path');
    $picture_path = $file_dir . $picture_dir;

    $pic_check = file_prepare_directory($picture_path, FILE_CREATE_DIRECTORY);
    $this->_directory_test = is_writable($picture_path);
    $this->assertTrue($this->_directory_test, "The directory $picture_path doesn't exist or is not writable. Further tests won't be made.");
  }

  function testNoPicture() {
    $this->backdropLogin($this->user);

    // Try to upload a file that is not an image for the user picture.
    $not_an_image = current($this->backdropGetTestFiles('html'));
    $this->saveUserPicture($not_an_image);
    $supported_extensions = image_get_supported_extensions();
    $this->assertRaw(t('Only images with the following extensions are allowed: @formats.', array('@formats' => implode(', ', $supported_extensions))), 'Non-image files are not accepted.');
  }

  /**
   * Do the test:
   *  GD Toolkit is installed
   *  Picture has invalid dimension
   *
   * results: The image should be uploaded because ImageGDToolkit resizes the picture
   */
  function testWithGDinvalidDimension() {
    if ($this->_directory_test && image_get_toolkit()) {
      $this->backdropLogin($this->user);

      $image = current($this->backdropGetTestFiles('image'));
      $info = image_get_info($image->uri);

      // Set new variables: invalid dimensions, valid filesize (0 = no limit).
      $test_dim = ($info['width'] - 10) . 'x' . ($info['height'] - 10);
      config('system.core')
        ->set('user_picture_dimensions', $test_dim)
        ->set('user_picture_file_size', 0)
        ->save();

      $pic_path = $this->saveUserPicture($image);
      // Check that the image was resized and is being displayed on the
      // user's profile page.
      $text = t('The image was resized to fit within the maximum allowed dimensions of %dimensions pixels.', array('%dimensions' => $test_dim));
      $this->assertRaw($text, 'Image was resized.');
      $alt = t("@user's picture", array('@user' => user_format_name($this->user)));
      $style = config_get('system.core', 'user_picture_style');
      $this->assertRaw(image_style_url($style, $pic_path), "Image is displayed in user's edit page");

      // Check if file is located in proper directory.
      $this->assertTrue(is_file($pic_path), "File is located in proper directory");
    }
  }

  /**
   * Do the test:
   *  GD Toolkit is installed
   *  Picture has invalid size
   *
   * results: The image should be uploaded because ImageGDToolkit resizes the picture
   */
  function testWithGDinvalidSize() {
    if ($this->_directory_test && image_get_toolkit()) {
      $this->backdropLogin($this->user);

      // Images are sorted first by size then by name. We need an image
      // bigger than 1 KB so we'll grab the last one.
      $files = $this->backdropGetTestFiles('image');
      $image = end($files);
      $info = image_get_info($image->uri);

      // Set new variables: valid dimensions, invalid filesize.
      $test_dim = ($info['width'] + 10) . 'x' . ($info['height'] + 10);
      $test_size = 1;
      config('system.core')
        ->set('user_picture_dimensions', $test_dim)
        ->set('user_picture_file_size', $test_size)
        ->save();

      $pic_path = (string) $this->saveUserPicture($image);

      // Test that the upload failed and that the correct reason was cited.
      $text = t('The specified file %filename could not be uploaded.', array('%filename' => $image->filename));
      $this->assertRaw($text, 'Upload failed.');
      $text = t('The file is %filesize exceeding the maximum file size of %maxsize.', array('%filesize' => format_size(filesize($image->uri)), '%maxsize' => format_size($test_size * 1024)));
      $this->assertRaw($text, 'File size cited as reason for failure.');

      // Check if file is not uploaded.
      $this->assertFalse(is_file($pic_path), 'File was not uploaded.');
    }
  }

  /**
   * Do the test:
   *  GD Toolkit is not installed
   *  Picture has invalid size
   *
   * results: The image shouldn't be uploaded
   */
  function testWithoutGDinvalidDimension() {
    if ($this->_directory_test && !image_get_toolkit()) {
      $this->backdropLogin($this->user);

      $image = current($this->backdropGetTestFiles('image'));
      $info = image_get_info($image->uri);

      // Set new variables: invalid dimensions, valid filesize (0 = no limit).
      $test_dim = ($info['width'] - 10) . 'x' . ($info['height'] - 10);
      config('system.core')
        ->set('user_picture_dimensions', $test_dim)
        ->set('user_picture_file_size', 0)
        ->save();

      $pic_path = $this->saveUserPicture($image);

      // Test that the upload failed and that the correct reason was cited.
      $text = t('The specified file %filename could not be uploaded.', array('%filename' => $image->filename));
      $this->assertRaw($text, 'Upload failed.');
      $text = t('The image is too large; the maximum dimensions are %dimensions pixels.', array('%dimensions' => $test_dim));
      $this->assertRaw($text, 'Checking response on invalid image (dimensions).');

      // Check if file is not uploaded.
      $this->assertFalse(is_file($pic_path), 'File was not uploaded.');
    }
  }

  /**
   * Do the test:
   *  GD Toolkit is not installed
   *  Picture has invalid size
   *
   * results: The image shouldn't be uploaded
   */
  function testWithoutGDinvalidSize() {
    if ($this->_directory_test && !image_get_toolkit()) {
      $this->backdropLogin($this->user);

      $image = current($this->backdropGetTestFiles('image'));
      $info = image_get_info($image->uri);

      // Set new variables: valid dimensions, invalid filesize.
      $test_dim = ($info['width'] + 10) . 'x' . ($info['height'] + 10);
      $test_size = 1;
      config('system.core')
        ->set('user_picture_dimensions', $test_dim)
        ->set('user_picture_file_size', $test_size)
        ->save();

      $pic_path = $this->saveUserPicture($image);

      // Test that the upload failed and that the correct reason was cited.
      $text = t('The specified file %filename could not be uploaded.', array('%filename' => $image->filename));
      $this->assertRaw($text, 'Upload failed.');
      $text = t('The file is %filesize exceeding the maximum file size of %maxsize.', array('%filesize' => format_size(filesize($image->uri)), '%maxsize' => format_size($test_size * 1024)));
      $this->assertRaw($text, 'File size cited as reason for failure.');

      // Check if file is not uploaded.
      $this->assertFalse(is_file($pic_path), 'File was not uploaded.');
    }
  }

  /**
   * Do the test:
   *  Picture is valid (proper size and dimension)
   *
   * results: The image should be uploaded
   */
  function testPictureIsValid() {
    if ($this->_directory_test) {
      $this->backdropLogin($this->user);

      $image = current($this->backdropGetTestFiles('image'));
      $info = image_get_info($image->uri);

      // Set new variables: valid dimensions, valid filesize (0 = no limit).
      $test_dim = ($info['width'] + 10) . 'x' . ($info['height'] + 10);
      config('system.core')
        ->set('user_picture_dimensions', $test_dim)
        ->set('user_picture_file_size', 0)
        ->save();

      $pic_path = $this->saveUserPicture($image);

      // Check if image is displayed in user's profile page.
      $this->backdropGet('user');
      $this->assertRaw(file_uri_target($pic_path), "Image is displayed in user's profile page");

      // Check if file is located in proper directory.
      $this->assertTrue(is_file($pic_path), 'File is located in proper directory');

      // Set new picture dimensions.
      $test_dim = ($info['width'] + 5) . 'x' . ($info['height'] + 5);
      config_set('system.core', 'user_picture_dimensions', $test_dim);

      $pic_path2 = $this->saveUserPicture($image);
      $this->assertNotEqual($pic_path, $pic_path2, 'Filename of second picture is different.');

      // Check if user picture has a valid file ID after saving the user.
      $account = user_load($this->user->uid, TRUE);
      $this->assertTrue(is_object($account->picture), 'User picture object is valid after user load.');
      $this->assertNotNull($account->picture->fid, 'User picture object has a FID after user load.');
      $this->assertTrue(is_file($account->picture->uri), 'File is located in proper directory after user load.');
      user_save($account);
      // Verify that the user save does not destroy the user picture object.
      $this->assertTrue(is_object($account->picture), 'User picture object is valid after user save.');
      $this->assertNotNull($account->picture->fid, 'User picture object has a FID after user save.');
      $this->assertTrue(is_file($account->picture->uri), 'File is located in proper directory after user save.');
    }
  }

  /**
   * Test HTTP schema working with user pictures.
   */
  function testExternalPicture() {
    $this->backdropLogin($this->user);
    // Set the default picture to an URI with a HTTP schema.
    $images = $this->backdropGetTestFiles('image');
    $image = $images[0];
    $pic_path = file_create_url($image->uri);
    config_set('system.core', 'user_picture_default', $pic_path);

    // Check if image is displayed in user's profile page.
    $this->backdropGet('user');

    // Get the user picture image via xpath.
    $elements = $this->xpath('//div[@class="user-picture"]/img');
    $this->assertEqual(count($elements), 1, "There is exactly one user picture on the user's profile page");
    $this->assertEqual($pic_path, (string) $elements[0]['src'], "User picture source is correct: " . $pic_path . " " . print_r($elements, TRUE));
  }

  /**
   * Tests deletion of user pictures.
   */
  function testDeletePicture() {
    $this->backdropLogin($this->user);

    $image = current($this->backdropGetTestFiles('image'));
    $info = image_get_info($image->uri);

    // Set new variables: valid dimensions, valid filesize (0 = no limit).
    $test_dim = ($info['width'] + 10) . 'x' . ($info['height'] + 10);
    config('system.core')
      ->set('user_picture_dimensions', $test_dim)
      ->set('user_picture_file_size', 0)
      ->save();

    // Save a new picture.
    $edit = array('files[picture_upload]' => backdrop_realpath($image->uri));
    $this->backdropPost('user/' . $this->user->uid . '/edit', $edit, t('Save'));

    // Load actual user data from database.
    $account = user_load($this->user->uid, TRUE);
    $pic_path = !empty($account->picture) ? $account->picture->uri : NULL;

    // Check if image is displayed in user's profile page.
    $this->backdropGet('user');
    $this->assertRaw(file_uri_target($pic_path), "Image is displayed in user's profile page");

    // Check if file is located in proper directory.
    $this->assertTrue(is_file($pic_path), 'File is located in proper directory');

    $edit = array('picture_delete' => 1);
    $this->backdropPost('user/' . $this->user->uid . '/edit', $edit, t('Save'));

    // Load actual user data from database.
    $account1 = user_load($this->user->uid, TRUE);
    $this->assertFalse($account1->picture, 'User object has no picture');

    $file = file_load($account->picture->fid);
    $this->assertFalse($file, 'File is removed from database');

    // Clear out PHP's file stat cache so we see the current value.
    clearstatcache();
    $this->assertFalse(is_file($pic_path), 'File is removed from file system');
  }

  function saveUserPicture($image) {
    $edit = array('files[picture_upload]' => backdrop_realpath($image->uri));
    $this->backdropPost('user/' . $this->user->uid . '/edit', $edit, t('Save'));

    // Load actual user data from database.
    $account = user_load($this->user->uid, TRUE);
    return !empty($account->picture) ? $account->picture->uri : NULL;
  }

  /**
   * Tests the admin form validates user picture settings.
   */
  function testUserPictureAdminFormValidation() {
    $this->backdropLogin($this->backdropCreateUser(array('administer account settings')));

    // The default values are valid.
    $this->backdropPost('admin/config/people/settings', array(), t('Save configuration'));
    $this->assertText(t('The configuration options have been saved.'), 'The default values are valid.');

    // The form does not save with an invalid file size.
    $edit = array(
      'user_picture_file_size' => $this->randomName(),
    );
    $this->backdropPost('admin/config/people/settings', $edit, t('Save configuration'));
    $this->assertNoText(t('The configuration options have been saved.'), 'The form does not save with an invalid file size.');
  }
}


class UserPermissionsTestCase extends BackdropWebTestCase {
  protected $profile = 'minimal';
  protected $admin_user;
  protected $editor_user;
  protected $admin_role_name;
  protected $editor_role_name;

  function setUp() {
    parent::setUp();

    $this->admin_user = $this->backdropCreateUser(array('administer permissions', 'access user profiles', 'administer site configuration', 'administer account settings', 'administer content types', 'administer modules'));
    $this->editor_user = $this->backdropCreateUser(array('access content'));

    // Find the new role names.
    $admin_roles = array_diff($this->admin_user->roles, array(BACKDROP_AUTHENTICATED_ROLE));
    $this->admin_role_name = reset($admin_roles);
    $editor_roles = array_diff($this->editor_user->roles, array(BACKDROP_AUTHENTICATED_ROLE));
    $this->editor_role_name = reset($editor_roles);
  }

  /**
   * Change user permissions and check user_access().
   */
  function testUserPermissionChanges() {
    $this->backdropLogin($this->admin_user);
    $role_name = $this->admin_role_name;
    $account = $this->admin_user;

    // Add a permission.
    $this->assertFalse(user_access('administer nodes', $account), 'User does not have "administer nodes" permission.');
    $edit = array();
    $edit[$role_name . '[administer nodes]'] = TRUE;
    $this->backdropPost('admin/config/people/permissions', $edit, t('Save permissions'));
    $this->assertText(t('The changes have been saved.'), 'Successful save message displayed.');
    backdrop_static_reset('user_roles');
    backdrop_static_reset('user_access');
    // Check the role and user account both have the permission.
    $this->assertTrue(user_role_has_permission($role_name, 'administer nodes'), 'Role now has "administer nodes" permission.');
    $this->assertTrue(user_access('administer nodes', $account), 'User now has "administer nodes" permission.');

    // Remove a permission.
    $this->assertTrue(user_role_has_permission($role_name, 'access user profiles'), 'Role has "access user profiles" permission.');
    $this->assertTrue(user_access('access user profiles', $account), 'User has "access user profiles" permission.');
    $edit = array();
    $edit[$role_name . '[access user profiles]'] = FALSE;
    $this->backdropPost('admin/config/people/permissions', $edit, t('Save permissions'));
    $this->assertText(t('The changes have been saved.'), 'Successful save message displayed.');
    backdrop_static_reset('user_roles');
    backdrop_static_reset('user_access');
    $this->assertFalse(user_role_has_permission($role_name, 'access user profiles'), 'Role no longer has "access user profiles" permission.');
    $this->assertFalse(user_access('access user profiles', $account), 'User no longer has "access user profiles" permission.');
  }

  /**
   * Test assigning of permissions for the administrator role.
   */
  function testAdministratorRole() {
    $this->backdropLogin($this->admin_user);
    $this->backdropGet('admin/config/people/roles');

    // Set the user's role to be the administrator role.
    $edit = array();
    $edit['user_admin_role'] = $this->admin_role_name;
    $this->backdropPost('admin/config/people/roles', $edit, t('Save configuration'));

    // Enable book module and ensure the 'administer book outlines' permission
    // is assigned by default.
    $edit = array();
    $edit['modules[System][book][enable]'] = TRUE;
    $this->backdropPost('admin/modules', $edit, t('Save configuration'));
    backdrop_static_reset('user_roles');
    $this->assertTrue(user_access('administer book outlines', $this->admin_user), 'The permission was automatically assigned to the administrator role');
  }

  /**
   * Test assigning of permissions for the editor role.
   */
  function testEditorRole() {
    $this->backdropLogin($this->admin_user);
    $this->backdropGet('admin/config/people/roles');

    // Before setting an admin role, check that no permissions are automatically
    // assigned on new content types.
    $this->backdropGet('admin/structure/types/add');
    $this->assertRaw(t('No permissions assigned for this content type. Content of this type may not be able to be created, updated or deleted until permissions have been configured appropriately.'));
    $this->assertNoFieldByXPath("//table[@id='permissions']//input[@checked]");

    // Set both an admin role and editor role.
    $edit = array();
    $edit['user_admin_role'] = $this->admin_role_name;
    $edit['user_editor_role'] = $this->editor_role_name;
    $this->backdropPost('admin/config/people/roles', $edit, t('Save configuration'));

    // Create a new content type and confirm the permissions are added.
    $this->backdropGet('admin/structure/types/add');
    $this->assertRaw(t('The %admin and %editor roles have been assigned permissions to create, edit, and delete content of this type.', array(
      '%admin' => $this->admin_role_name,
      '%editor' => $this->editor_role_name
    )));
    // Opposite of the above assertNoFieldByXPath(), confirm that there are at
    // least some permission checkboxes checked.
    $this->assertFieldByXPath("//table[@id='permissions']//input[@checked]");

    $content_type_permissions = array(
      'create content',
      'edit own content',
      'edit any content',
      'delete own content',
      'delete any content',
    );
    // In this case, both admin and editor checkboxes are checked.
    $role_names = array(
      $this->admin_role_name,
      $this->editor_role_name,
    );
    foreach ($content_type_permissions as $type_permission) {
      foreach ($role_names as $role_name) {
        if (!($type_permission == 'delete any content' && $role_name == $this->editor_role_name)) {
          $checkbox_id = backdrop_strtolower(str_replace(' ', '-', "edit $role_name $type_permission"));
          $this->assertFieldChecked($checkbox_id);
        }
      }
    }

    // Save the form with no other changes.
    $content_type_name = backdrop_strtolower($this->randomName());
    $edit = array(
      'name' => $content_type_name,
      'type' => $content_type_name,
    );
    $this->backdropPost(NULL, $edit, t('Save content type'));

    // Now check permissions were correctly assigned.
    $user_accounts = array(
      $this->admin_user,
      $this->editor_user,
    );
    backdrop_static_reset('user_roles');
    backdrop_static_reset('user_access');
    foreach ($content_type_permissions as $type_permission) {
      $permission_name = backdrop_strtolower(str_replace('content', "$content_type_name content", $type_permission));
      foreach ($user_accounts as $user_account) {
        if (!($type_permission == 'delete any content' && $user_account == $this->editor_user)) {
          $this->assertTrue(user_access($permission_name, $user_account));
        }
      }
    }
  }

  /**
   * Verify proper permission changes by user_role_change_permissions().
   */
  function testUserRoleChangePermissions() {
    $role_name = $this->admin_role_name;
    $account = $this->admin_user;

    // Verify current permissions.
    $this->assertFalse(user_access('administer nodes', $account), 'User does not have "administer nodes" permission.');
    $this->assertTrue(user_access('access user profiles', $account), 'User has "access user profiles" permission.');
    $this->assertTrue(user_access('administer site configuration', $account), 'User has "administer site configuration" permission.');

    // Change permissions.
    $permissions = array(
      'administer nodes' => 1,
      'access user profiles' => 0,
    );
    user_role_change_permissions($role_name, $permissions);

    // Verify proper permission changes.
    $this->assertTrue(user_access('administer nodes', $account), 'User now has "administer nodes" permission.');
    $this->assertFalse(user_access('access user profiles', $account), 'User no longer has "access user profiles" permission.');
    $this->assertTrue(user_access('administer site configuration', $account), 'User still has "administer site configuration" permission.');
  }
}

class UserAdminTestCase extends BackdropWebTestCase {
  /**
   * Registers a user and deletes it.
   */
  function testUserAdmin() {
    // Create admin user to delete registered user.
    $admin_user = $this->backdropCreateUser(array('administer users', 'access user profiles'));
    $admin_user->created -= 2;
    $admin_user->save();

    $user_a = $this->backdropCreateUser(array());
    $user_b = $this->backdropCreateUser(array('administer taxonomy'));
    $user_c = $this->backdropCreateUser(array('administer taxonomy'));

    $this->backdropLogin($admin_user);
    $this->backdropGet('admin/people');
    $this->assertText($user_a->name, 'Found user A on admin users page');
    $this->assertText($user_b->name, 'Found user B on admin users page');
    $this->assertText($user_c->name, 'Found user C on admin users page');
    $this->assertText($admin_user->name, 'Found Admin user on admin users page');

    // Test for existence of edit link in table.
    $link = l(t('Edit'), "user/$user_a->uid/edit", array('query' => array('destination' => 'admin/people')));
    $this->assertRaw($link, 'Found user A edit link on admin users page');

    // Filter the users by role. Grab the system-generated role name for User C.
    $c_roles = array_diff($user_c->roles, array(BACKDROP_AUTHENTICATED_ROLE));
    $role_id = reset($c_roles);
    $this->backdropGet('admin/people', array('query' => array('role' => $role_id)));

    // Check if the correct users show up when filtered by role.
    $this->assertNoText($user_a->name, 'User A not on filtered by role on admin users page');
    $this->assertNoText($user_b->name, 'User B not on filtered by role on admin users page');
    $this->assertText($user_c->name, 'User C on filtered by role on admin users page');

    // Test blocking of a user.
    $user_c = user_load($user_c->uid, TRUE);
    $this->assertEqual($user_c->status, 1, 'User C not blocked');

    $this->backdropGet('admin/people', array('query' => array('order' => 'created', 'sort' => 'asc')));
    $checkbox = $this->xpath('//form[@id="views-form-user-admin-page"]//tr[last()]//input[@type="checkbox"]');
    $user_c_checkbox = (string) $checkbox[0]['name'];

    $edit = array();
    $edit['action'] = 'user_block_user_action';
    $edit[$user_c_checkbox] = TRUE;
    $this->backdropPost('admin/people', $edit, t('Execute'), array('query' => array('order' => 'created', 'sort' => 'asc')));
    $status_result = $this->xpath('//form[@id="views-form-user-admin-page"]//tr[last()]//td[position()=3]');
    $this->assertEqual(trim($status_result[0]), 'Blocked', 'User C blocked');

    // Test unblocking of a user from /admin/people page and sending of activation mail
    $edit_unblock = array();
    $edit_unblock['action'] = 'user_unblock_user_action';
    $edit_unblock[$user_c_checkbox] = TRUE;
    $this->backdropPost('admin/people', $edit_unblock, t('Execute'), array('query' => array('order' => 'created', 'sort' => 'asc')));
    $status_result = $this->xpath('//form[@id="views-form-user-admin-page"]//tr[last()]//td[position()=3]');
    $this->assertEqual(trim($status_result[0]), 'Active', 'User C unblocked');
    $this->assertMail("to", $user_c->mail, "Activation mail sent to user C");

    // Test blocking and unblocking another user from /user/[uid]/edit form and sending of activation mail
    $user_d = $this->backdropCreateUser(array());
    $account1 = user_load($user_d->uid, TRUE);
    $this->backdropPost('user/' . $account1->uid . '/edit', array('status' => 0), t('Save'));
    $account1 = user_load($user_d->uid, TRUE);
    $this->assertEqual($account1->status, 0, 'User D blocked');
    $this->backdropPost('user/' . $account1->uid . '/edit', array('status' => TRUE), t('Save'));
    $account1 = user_load($user_d->uid, TRUE);
    $this->assertEqual($account1->status, 1, 'User D unblocked');
    $this->assertMail("to", $account1->mail, "Activation mail sent to user D");
  }
}

class UserAdminSettingsFormTest extends SystemConfigFormCase {
  public function setUp() {
    parent::setUp('contact');
    module_load_include('admin.inc', 'user');
    $this->form_id = 'user_admin_settings';
    $this->values = array(
      'user_picture_path' => array(
        '#value' => $this->randomName(10),
        '#config_name' => 'system.core',
        '#config_key' => 'user_picture_path',
      ),
      // The contact_default_status item tests saving via
      // system_config_settings() to a second config file.
      'contact_default_status' => array(
        '#value' => NULL,
        '#config_name' => 'contact.settings',
        '#config_key' => 'contact_default_status',
      ),
    );
  }
}

class UserAdminSettingsEmailFormTest extends SystemConfigFormCase {
  public function setUp() {
    parent::setUp();
    module_load_include('admin.inc', 'user');
    $this->form_id = 'user_settings_email';
    $this->values = array(
      'user_mail_cancel_confirm_body' => array(
        '#value' => $this->randomName(),
        '#config_name' => 'user.mail',
        '#config_key' => 'cancel_confirm_body',
      ),
      'user_mail_cancel_confirm_subject' => array(
        '#value' => $this->randomName(20),
        '#config_name' => 'user.mail',
        '#config_key' => 'cancel_confirm_subject',
      ),
    );
  }
}

/**
 * Tests for user-configurable time zones.
 */
class UserTimeZoneFunctionalTest extends BackdropWebTestCase {
  /**
   * Tests the display of dates and time when user-configurable time zones are set.
   */
  function testUserTimeZone() {
    // Setup date/time settings for Los Angeles time.
    config('system.date')
      ->set('user_configurable_timezones', 1)
      ->set('default_timezone', 'America/Los_Angeles')
      ->save();

    // Include the timezone in the medium date format.
    $format = system_date_format_load('medium');
    $format['pattern'] = 'Y-m-d H:i T';
    system_date_format_save($format);

    // Create a user account and login.
    $web_user = $this->backdropCreateUser();
    $this->backdropLogin($web_user);

    // Create some nodes with different authored-on dates.
    // One date in PST (winter time):
    $date1 = '2007-03-09 21:00:00 -0800';
    // Two dates in PDT (summer time):
    $date2 = '2007-03-12 01:00:00 -0700';
    $date3 = '2007-03-25 21:00:00 -0700';
    $node1 = $this->backdropCreateNode(array('created' => strtotime($date1), 'type' => 'post'));
    $node2 = $this->backdropCreateNode(array('created' => strtotime($date2), 'type' => 'post'));
    $node3 = $this->backdropCreateNode(array('created' => strtotime($date3), 'type' => 'post'));

    // Confirm date format and time zone.
    $this->backdropGet("node/$node1->nid");
    $this->assertText('2007-03-09 21:00 PST', 'Date should be PST.');
    $this->backdropGet("node/$node2->nid");
    $this->assertText('2007-03-12 01:00 PDT', 'Date should be PDT.');
    $this->backdropGet("node/$node3->nid");
    $this->assertText('2007-03-25 21:00 PDT', 'Date should be PDT.');

    // Change user time zone to Santiago time.
    $edit = array();
    $edit['mail'] = $web_user->mail;
    $edit['timezone'] = 'Europe/Paris';
    $this->backdropPost("user/$web_user->uid/edit", $edit, t('Save'));
    $this->assertText(t('The changes have been saved.'), 'Time zone changed to Central Europe time.');

    // Confirm date format and time zone.
    $this->backdropGet("node/$node1->nid");
    $this->assertText('2007-03-10 06:00 CET', 'Date should be Central European Time; nine hours ahead of PST.');
    $this->backdropGet("node/$node2->nid");
    $this->assertText('2007-03-12 09:00 CET', 'Date should be Central European Time; eight hours ahead of PDT');
    $this->backdropGet("node/$node3->nid");
    $this->assertText('2007-03-26 06:00 CEST', 'Date should be Central European Summer Time; nine hours ahead of PDT.');
  }
}

/**
 * Test user autocompletion.
 */
class UserAutocompleteTestCase extends BackdropWebTestCase {
  protected $profile = 'testing';

  /**
   * @var User
   */
  protected $unprivileged_user;

  /**
   * @var User
   */
  protected $privileged_user;

  function setUp() {
    parent::setUp();

    // Set up two users with different permissions to test access.
    $this->unprivileged_user = $this->backdropCreateUser();
    $this->privileged_user = $this->backdropCreateUser(array('access user profiles'));
  }

  /**
   * Tests access to user autocompletion and verify the correct results.
   */
  function testUserAutocomplete() {
    // Check access from unprivileged user, should be denied.
    $this->backdropLogin($this->unprivileged_user);
    $this->backdropGet('user/autocomplete/' . $this->unprivileged_user->name[0]);
    $this->assertResponse(403, 'Autocompletion access denied to user without permission.');

    // Check access from privileged user.
    $this->backdropLogout();
    $this->backdropLogin($this->privileged_user);
    $this->backdropGet('user/autocomplete/' . $this->unprivileged_user->name[0]);
    $this->assertResponse(200, 'Autocompletion access allowed.');

    // Using first letter of the user's name, make sure the user's full name is in the results.
    $this->assertRaw($this->unprivileged_user->name, 'User name found in autocompletion results.');
  }
}


/**
 * Tests user links in the header menu.
 */
class UserAccountLinksUnitTests extends BackdropWebTestCase {
  protected $profile = 'testing';

  /**
   * Test the user login block.
   */
  function testAccountMenu() {
    // Create a regular user.
    $user = $this->backdropCreateUser(array());

    // Log in and get the homepage.
    $this->backdropLogin($user);
    $this->backdropGet('<front>');

    // For a logged-in user, expect the secondary menu to have links for "My
    // account" and "Log out".
    $link = $this->xpath('//*[contains(@class, :menu_id)]//a[contains(@href, :href) and text()=:text]', array(
      ':menu_id' => 'header-menu',
      ':href' => 'user',
      ':text' => 'My account',
    ));
    $this->assertEqual(count($link), 1, 'My account link is in secondary menu.');

    $link = $this->xpath('//*[contains(@class, :menu_id)]//a[contains(@href, :href) and text()=:text]', array(
      ':menu_id' => 'header-menu',
      ':href' => 'user/logout',
      ':text' => 'Log out',
    ));
    $this->assertEqual(count($link), 1, 'Log out link is in secondary menu.');

    // Log out and get the homepage.
    $this->backdropLogout();
    $this->backdropGet('<front>');

    // For a logged-out user, expect no secondary links.
    $element = $this->xpath('//ul[@id=:menu_id]', array(':menu_id' => 'secondary-menu-links'));
    $this->assertEqual(count($element), 0, 'No secondary-menu for logged-out users.');
  }
}

/**
 * Test user blocks.
 */
class UserBlocksUnitTests extends BackdropWebTestCase {
  protected $profile = 'minimal';

  /**
   * Tests the secondary menu.
   */
  function testUserLoginBlock() {
    // Create a user with some permission that anonymous users lack.
    $user = $this->backdropCreateUser(array('administer permissions'));

    // Add the block to the default layout.
    $layout = layout_load('default');
    $layout->addBlock('user', 'login', 'sidebar');
    $layout->save();

    // Log in using the block.
    $edit = array();
    $edit['name'] = $user->name;
    $edit['pass'] = $user->pass_raw;
    $this->backdropPost('admin/config/people/permissions', $edit, t('Log in'));
    $this->assertNoText(t('User login'), 'Logged in.');

    // Check that we are still on the same page.
    $this->assertEqual(url('admin/config/people/permissions', array('absolute' => TRUE)), $this->getUrl(), 'Still on the same page after login for access denied page');

    // Now, log out and repeat with a non-403 page.
    $this->backdropLogout();
    $this->backdropPost('filter/tips', $edit, t('Log in'));
    $this->assertNoText(t('User login'), 'Logged in.');
    $this->assertPattern('!<title.*?' . t('Compose tips') . '.*?</title>!', 'Still on the same page after login for allowed page');

    // Check that the user login block is not vulnerable to information
    // disclosure to third party sites.
    $this->backdropLogout();
    $this->backdropPost('<front>', $edit, t('Log in'), array('query' => array('destination' => 'http://example.com/')));
    // Check that we remain on the site after login.
    $this->assertEqual(url('node', array('absolute' => TRUE)), $this->getUrl(), 'Redirected to frontpage and not external site after login.');
  }

  function setUp() {
    parent::setUp('menu');
  }

  /**
   * Tests disabling the 'My account' link.
   */
  function testDisabledAccountLink() {
    // Create an admin user and log in.
    $this->backdropLogin($this->backdropCreateUser(array('access administration pages', 'administer menu')));

    // Verify that the 'My account' link is enabled.
    $this->backdropGet('admin/structure/menu/manage/user-menu');
    $label = $this->xpath('//label[contains(.,:text)]/@for', array(':text' => 'Enable My account menu link'));
    $this->assertFieldChecked((string) $label[0], "The 'My account' link is enabled by default.");

    // Disable the 'My account' link.
    $input = $this->xpath('//input[@id=:field_id]/@name', array(':field_id' => (string)$label[0]));
    $edit = array(
      (string) $input[0] => FALSE,
    );
    $this->backdropPost('admin/structure/menu/manage/user-menu', $edit, t('Save configuration'));

    // Get the homepage.
    $this->backdropGet('<front>');

    // Verify that the 'My account' link does not appear when disabled.
    $link = $this->xpath('//ul[@id=:menu_id]/li/a[contains(@href, :href) and text()=:text]', array(
      ':menu_id' => 'secondary-menu-links',
      ':href' => 'user',
      ':text' => 'My account',
    ));
    $this->assertEqual(count($link), 0, 'My account link is not in the secondary menu.');
  }

}

/**
 * Test case to test user_save() behavior.
 */
class UserSaveTestCase extends BackdropWebTestCase {
  protected $profile = 'testing';

  /**
   * Test creating a user with arbitrary uid.
   */
  function testUserImport() {
    // User ID must be a number that is not in the database.
    $max_uid = db_query('SELECT MAX(uid) FROM {users}')->fetchField();
    $test_uid = $max_uid + mt_rand(1000, 1000000);
    $test_name = $this->randomName();

    // Create the base user, based on backdropCreateUser().
    $user = entity_create('user', array(
      'name' => $test_name,
      'uid' => $test_uid,
      'mail' => $test_name . '@example.com',
      'is_new' => TRUE,
      'pass' => user_password(),
      'status' => 1,
    ));
    $user_by_return = $user->save();
    $this->assertIdentical($user_by_return, SAVED_NEW, 'Loading user by return of user_save().');

    // Test if created user exists.
    $user_by_uid = user_load($test_uid);
    $this->assertTrue($user_by_uid, 'Loading user by uid.');

    $user_by_name = user_load_by_name($test_name);
    $this->assertTrue($user_by_name, 'Loading user by name.');
  }
}

/**
 * Test the create user administration page.
 */
class UserCreateTestCase extends BackdropWebTestCase {
  protected $profile = 'testing';

  function setUp() {
    parent::setUp(array('views'));
  }

  /**
   * Create a user through the administration interface and ensure that it
   * displays in the user list.
   */
  protected function testUserAdd() {
    $user = $this->backdropCreateUser(array('administer users'));
    $this->backdropLogin($user);

    // Test user creation page for valid fields.
    $this->backdropGet('admin/people/create');
    $this->assertFieldbyId('edit-status-0', 0, 'The user status option Blocked exists.', 'User login');
    $this->assertFieldbyId('edit-status-1', 1, 'The user status option Active exists.', 'User login');
    $this->assertFieldByXPath('//input[@type="radio" and @id="edit-status-1" and @checked="checked"]', NULL, 'Default setting for user status is active.');

    // We create two users, notifying one and not notifying the other, to
    // ensure that the tests work in both cases.
    foreach (array(FALSE, TRUE) as $notify) {
      $name = $this->randomName();
      $edit = array(
        'name' => $name,
        'mail' => $this->randomName() . '@example.com',
        'pass' => $pass = $this->randomString(),
        'notify' => $notify,
      );
      $this->backdropPost('admin/people/create', $edit, t('Create new account'));

      if ($notify) {
        $this->assertText(t('A welcome message with further instructions has been emailed to the new user @name.', array('@name' => $edit['name'])), 'User created');
        $this->assertEqual(count($this->backdropGetMails()), 1, 'Notification email sent');
      }
      else {
        $this->assertText(t('Created a new user account for @name. No email has been sent.', array('@name' => $edit['name'])), 'User created');
        $this->assertEqual(count($this->backdropGetMails()), 0, 'Notification email not sent');
      }

      $this->backdropGet('admin/people');
      $this->assertText($edit['name'], 'User found in list of users');
      $user = user_load_by_name($name);
      $this->assertEqual($user->status == 1, 'User is not blocked');
    }

    // Test that '0' is considered a password. We have to disable password
    // required score for that.
    config_set('system.core', 'user_password_reject_weak', FALSE);
    $name = $this->randomName();
    $edit = array(
      'name' => $name,
      'mail' => $name . '@example.com',
      'pass' => 0,
      'notify' => FALSE,
    );
    $this->backdropPost('admin/people/create', $edit, t('Create new account'));
    $this->assertText(t('Created a new user account for @name. No email has been sent.', array('@name' => $edit['name'])), 'User created with password 0');
    $this->assertNoText('Password field is required');
  }

  /**
   * Tests setting a weak password.
   *
   * A user should not be able to set a weak password if required.
   */
  public function testUserWithWeakPassword() {
    $admin = $this->backdropCreateUser(array('administer users'));
    $this->backdropLogin($admin);

    // Set required strong password.
    $config = config('system.core');
    $config->set('user_password_reject_weak', TRUE);
    $config->set('user_password_strength_threshold', 50);
    $config->save();

    $name = $this->randomName();
    $email = $this->randomName() . '@example.com';
    $edit = array(
      'name' => $name,
      'mail' => $email,
      'pass' => $name,
      'notify' => FALSE,
    );

    $this->backdropPost('admin/people/create', $edit, t('Create new account'));
    $this->assertRaw(t("The password cannot be the same as the username."));

    $edit['pass'] = $email;
    $this->backdropPost('admin/people/create', $edit, t('Create new account'));
    $this->assertRaw(t("The password cannot be the same as the email."));

    $edit['pass'] = '123abcdef';
    $this->backdropPost('admin/people/create', $edit, t('Create new account'));
    $this->assertRaw(t("The password is too weak. Please consider making your password longer or more complex"));

    // Require a "strong" password, not just the default "fair".
    $config->set('user_password_strength_threshold', 90);
    $config->save();

    $edit['name'] = $this->randomName();
    $edit['mail'] = $this->randomName() . '@example.com';
    $this->backdropPost('admin/people/create', $edit, t('Create new account'));
    $this->assertRaw(t("The password is too weak. Please consider making your password longer or more complex"));

    $edit['pass'] = '123abcdefghijklmnopqrstuvwx';
    $this->backdropPost('admin/people/create', $edit, t('Create new account'));
    $this->assertRaw(t("Created a new user account"));

    // Allow weak passwords.
    $config->set('user_password_reject_weak', FALSE);
    $config->save();

    $edit['name'] = $this->randomName();
    $edit['mail'] = $this->randomName() . '@example.com';
    $edit['pass'] = '123';
    $this->backdropPost('admin/people/create', $edit, t('Create new account'));
    $this->assertRaw(t("Created a new user account"));
  }
}

/**
 * Test case to test user_save() behavior.
 */
class UserEditTestCase extends BackdropWebTestCase {
  protected $profile = 'testing';

  /**
   * Test user edit page.
   */
  function testUserEdit() {
    // Test user edit functionality with user pictures disabled.
    $config = config('system.core');
    $config->set('user_pictures', 0)->save();
    $user1 = $this->backdropCreateUser(array('change own username'));
    $user2 = $this->backdropCreateUser(array());
    $this->backdropLogin($user1);

    // Test that error message appears when attempting to use a non-unique user name.
    $edit['name'] = $user2->name;
    $this->backdropPost("user/$user1->uid/edit", $edit, t('Save'));
    $this->assertRaw(t('The name %name is already taken.', array('%name' => $edit['name'])));

    // Repeat the test with user pictures enabled, which modifies the form.
    $config->set('user_pictures', 1)->save();

    $this->backdropPost("user/$user1->uid/edit", $edit, t('Save'));
    $this->assertRaw(t('The name %name is already taken.', array('%name' => $edit['name'])));

    // Test that the error message appears when attempting to change the mail or
    // pass without the current password.
    $edit = array();
    $edit['mail'] = $this->randomName() . '@new.example.com';
    $this->backdropPost("user/$user1->uid/edit", $edit, t('Save'));
    $this->assertRaw(t("Your current password is missing or incorrect; it's required to change the %name.", array('%name' => t('Email address'))));

    $edit['current_pass'] = $user1->pass_raw;
    $this->backdropPost("user/$user1->uid/edit", $edit, t('Save'));
    $this->assertRaw(t("The changes have been saved."));

    // Test that the user must enter current password before changing passwords.
    $edit = array();
    $edit['pass'] = $new_pass = $this->randomName();
    $this->backdropPost("user/$user1->uid/edit", $edit, t('Save'));
    $this->assertRaw(t("Your current password is missing or incorrect; it's required to change the %name.", array('%name' => t('Password'))));

    // Try again with the current password.
    $edit['current_pass'] = $user1->pass_raw;
    $this->backdropPost("user/$user1->uid/edit", $edit, t('Save'));
    $this->assertRaw(t("The changes have been saved."));

    // Make sure the user can log in with their new password.
    $this->backdropLogout();
    $user1->pass_raw = $new_pass;
    $this->backdropLogin($user1);
    $this->backdropLogout();
  }

  /**
   * Tests setting the password to "0".
   *
   * At one point it was found that logging in with a password that is literally
   * "0" was not possible. This test prevents regression of this behavior.
   */
  public function testUserWith0Password() {
    $admin = $this->backdropCreateUser(array('administer users'));
    $this->backdropLogin($admin);
    // Create a regular user.
    $user1 = $this->backdropCreateUser(array());
    // Disable strong password required.
    config_set('system.core', 'user_password_reject_weak', FALSE);

    $edit = array('pass' => '0');
    $this->backdropPost("user/" . $user1->uid . "/edit", $edit, t('Save'));
    $this->assertRaw(t("The changes have been saved."));

    $this->backdropLogout();
    $user1->pass_raw = '0';
    $this->backdropLogin($user1);
    $this->backdropLogout();
  }
}

/**
 * Tests editing a user account with and without a form rebuild.
 */
class UserEditRebuildTestCase extends BackdropWebTestCase {

  function setUp() {
    parent::setUp('user_form_test');
  }

  /**
   * Test user edit page when the form is set to rebuild.
   */
  function testUserEditFormRebuild() {
    $user1 = $this->backdropCreateUser(array('change own username'));
    $this->backdropLogin($user1);

    $roles = array_keys($user1->roles);
    // Save the user form twice.
    $edit = array();
    $edit['current_pass'] = $user1->pass_raw;
    $this->backdropPost("user/$user1->uid/edit", $edit, t('Save'));
    $this->assertRaw(t("The changes have been saved."));
    $this->backdropPost("user/$user1->uid/edit", $edit, t('Save'));
    $this->assertRaw(t("The changes have been saved."));
    $saved_user1 = entity_load_unchanged('user', $user1->uid);
    $this->assertEqual(count($roles), count($saved_user1->roles), 'Count of user roles in database matches original count.');
    $diff = array_diff(array_keys($saved_user1->roles), $roles);
    $this->assertTrue(empty($diff), format_string('User roles in database match original: @roles', array('@roles' => implode(', ', $saved_user1->roles))));
    // Set variable that causes the form to be rebuilt in user_form_test.module.
    state_set('user_form_test_user_profile_form_rebuild', TRUE);
    $this->backdropPost("user/$user1->uid/edit", $edit, t('Save'));
    $this->assertRaw(t("The changes have been saved."));
    $this->backdropPost(NULL, $edit, t('Save'));
    $this->assertRaw(t("The changes have been saved."));
    $saved_user1 = entity_load_unchanged('user', $user1->uid);
    $this->assertEqual(count($roles), count($saved_user1->roles), 'Count of user roles in database matches original count.');
    $diff = array_diff(array_keys($saved_user1->roles), $roles);
    $this->assertTrue(empty($diff), format_string('User roles in database match original: @roles', array('@roles' => implode(', ', $saved_user1->roles))));
  }
}

/**
 * Test case for user signatures.
 */
class UserSignatureTestCase extends BackdropWebTestCase {

  /**
   * @var object
   */
  protected $full_html_format;

  /**
   * @var object
   */
  protected $filtered_html_format;

  /**
   * @var User
   */
  protected $web_user;

  /**
   * @var User
   */
  protected $admin_user;

  function setUp() {
    parent::setUp('comment');

    // Enable user signatures.
    config_set('system.core', 'user_signatures', 1);

    // Prefetch text formats.
    $this->full_html_format = filter_format_load('full_html');
    $this->filtered_html_format = filter_format_load('filtered_html');

    // Create regular and administrative users.
    $this->web_user = $this->backdropCreateUser(array());
    $admin_permissions = array('administer comments');
    foreach (filter_formats() as $format) {
      if ($permission = filter_permission_name($format)) {
        $admin_permissions[] = $permission;
      }
    }
    $this->admin_user = $this->backdropCreateUser($admin_permissions);
  }

  /**
   * Test that a user can change their signature format and that it is respected
   * upon display.
   */
  function testUserSignature() {
    // Enable comment subjects on 'page' nodes
    $node_type = node_type_get_type('page');
    $node_type->settings['comment_title_options'] = COMMENT_TITLE_CUSTOM;
    node_type_save($node_type);

    // Create a new node with comments on.
    $node = $this->backdropCreateNode(array('comment' => COMMENT_NODE_OPEN));

    // Verify that user signature field is not displayed on registration form.
    $this->backdropGet('user/register');
    $this->assertNoText(t('Signature'));

    // Log in as a regular user and create a signature.
    $this->backdropLogin($this->web_user);
    $signature_text = "<h1>" . $this->randomName() . "</h1>";
    $edit = array(
      'signature[value]' => $signature_text,
    );
    $this->backdropPost('user/' . $this->web_user->uid . '/edit', $edit, t('Save'));

    // Verify that values were stored.
    $this->backdropGet('user/' . $this->web_user->uid . '/edit');
    $this->assertFieldByName('signature[value]', $edit['signature[value]'], 'Submitted signature text found.');

    // Create a comment.
    $langcode = LANGUAGE_NONE;
    $edit = array();
    $edit['subject'] = $this->randomName(8);
    $edit['comment_body[' . $langcode . '][0][value]'] = $this->randomName(16);
    $this->backdropPost('comment/reply/' . $node->nid, $edit, t('Preview'));
    $this->backdropPost(NULL, array(), t('Save'));

    // Get the comment ID. (This technique is the same one used in the Comment
    // module's CommentHelperCase test case.)
    preg_match('/#comment-([0-9]+)/', $this->getURL(), $match);
    $comment_id = $match[1];

    // Log in as an administrator and edit the comment to use Raw HTML
    // (full_html), so that the comment text itself is not filtered at all.
    $this->backdropLogin($this->admin_user);
    $edit['comment_body[' . $langcode . '][0][format]'] = $this->full_html_format->format;
    $this->backdropPost('comment/' . $comment_id . '/edit', $edit, t('Save'));

    // Assert that the signature did not make it through unfiltered.
    $this->backdropGet('node/' . $node->nid);
    $this->assertNoRaw($signature_text, 'Unfiltered signature text not found.');
    $this->assertRaw(check_markup($signature_text, $this->filtered_html_format->format), 'Filtered signature text found.');
  }
}

/*
 * Test that a user, having editing their own account, can still log in.
 */
class UserEditedOwnAccountTestCase extends BackdropWebTestCase {
  protected $profile = 'testing';

  /**
   * Tests a user editing their own account.
   */
  function testUserEditedOwnAccount() {
    // Change account setting 'Who can register accounts?' to Administrators
    // only.
    config_set('system.core', 'user_register', USER_REGISTER_ADMINISTRATORS_ONLY);

    // Create a new user account and log in.
    $account = $this->backdropCreateUser(array('change own username'));
    $this->backdropLogin($account);

    // Change own username.
    $edit = array();
    $edit['name'] = $this->randomName();
    $this->backdropPost('user/' . $account->uid . '/edit', $edit, t('Save'));

    // Log out.
    $this->backdropLogout();

    // Set the new name on the user account and attempt to log back in.
    $account->name = $edit['name'];
    $this->backdropLogin($account);

    // Attempt to change username to an email other than my own.
    $edit['name'] = $this->randomName() . '@example.com';
    $this->backdropPost('user/' . $account->uid . '/edit', $edit, t('Save'));
    $this->assertText(t('An email address was provided as a username, but does not match the account email address.', array('%name' => $edit['name'])), 'Error message found when an email username does not match user email.');
    $this->assertNoText(t('The changes have been saved.'), 'The user account was not saved.');

    // Lookup user by name to make sure we didn't actually change the name.
    $changed = user_load_by_name($edit['name']);
    $this->assertFalse($changed, 'Username was not changed to email address other than my own.');

    // Change username to my email address.
    $edit['name'] = $account->mail;
    $this->backdropPost('user/' . $account->uid . '/edit', $edit, t('Save'));
    $this->assertText(t('The changes have been saved.'), 'The user account was saved.');

    // Test that 'verify_email_match' turned off allows emails that don't match.
    config_set('system.core', 'user_email_match', FALSE);

    // Change username to random, non-matching email address.
    $edit['name'] = $this->randomName() . '@example.com';
    $this->backdropPost('user/' . $account->uid . '/edit', $edit, t('Save'));
    $this->assertText(t('The changes have been saved.'), 'The user account was saved.');
  }
}

/**
 * Test case to test adding, editing and deleting roles.
 */
class UserRoleAdminTestCase extends BackdropWebTestCase {
  protected $profile = 'testing';

  /**
   * @var User
   */
  protected $admin_user;

  function setUp() {
    parent::setUp();
    $this->admin_user = $this->backdropCreateUser(array('administer permissions', 'administer users', 'assign roles'));
  }

  /**
   * Test adding, renaming and deleting roles.
   */
  function testRoleAdministration() {
    $this->backdropLogin($this->admin_user);

    // Visit the main roles administration page.
    $this->backdropGet('admin/config/people/roles');

    // Ensure both submit buttons exist in the "Add role" form.
    $this->clickLink(t('Add role'));
    $this->assertUrl('admin/config/people/roles/add', array(), 'Redirected to correct URL after clicking the "+ Add role" link.');
    $this->assertTitle(t('Add role | Backdrop CMS'), 'The page title on the form page is "Add role".');
    $this->assertRaw(t('Save and set permissions'), '"Save and set permissions" button found on "Add role" form.');
    $this->assertRaw(t('Save role'), '"Save role" button found on "Add role" form.');
    $this->clickLink(t('Cancel'));
    $this->assertRaw(t('Add role'), 'Redirected to the main roles listing page.');

    // Test adding a role using the 'Save role' button.
    $role1_name = '123';
    $role1_description = 'Help text for 123 role.';
    $edit = array(
      'name' => $role1_name,
      'label' => $role1_name,
      'description' => $role1_description,
    );
    $this->backdropPost('admin/config/people/roles/add', $edit, t('Save role'));
    $this->assertText(t('The 123 role has been added.'), 'The role has been added.');
    $this->assertUrl('admin/config/people/roles', array(), 'Redirected to correct URL after clicking the "Save role" button.');
    backdrop_static_reset('user_roles');
    $role1 = user_role_load($role1_name);
    $this->assertTrue(is_object($role1), 'The role was successfully loaded from config.');

    // Ensure only one submit button exists in the "Edit role" form.
    $this->clickLink(t('Configure role'), 3);
    $this->assertUrl('admin/config/people/roles/configure/' . $role1_name, array(), 'Redirected to correct URL after clicking the "Configure role" operation.');
    $this->assertTitle(t('Configure role | Backdrop CMS'), 'The page title on the form is "Configure role".');
    $this->assertNoRaw(t('Save and set permissions'), '"Save and set permissions" button not found on "Configure role" form.');
    $this->assertRaw(t('Save role'), '"Save role" button found on "Configure role" form.');
    $this->clickLink(t('Cancel'));
    $this->assertRaw(t('Add role'), 'Redirected to the main roles listing page.');

    // Test adding a role using the 'Save and set permissions' button.
    $role2_name = '456';
    $role2_description = 'Description for 456 role.';
    $edit = array(
      'name' => $role2_name,
      'label' => $role2_name,
      'description' => $role2_description,
    );
    $this->backdropPost('admin/config/people/roles/add', $edit, t('Save and set permissions'));
    $this->assertText(t('The 456 role has been added.'), 'The role has been added.');
    $this->assertUrl('admin/config/people/permissions', array(), 'Redirected to correct URL after clicking the "Save and set permissions" button.');
    backdrop_static_reset('user_roles');
    $role2 = user_role_load($role2_name);
    $this->assertTrue(is_object($role2), 'The role was successfully loaded from config.');

    // Try adding a duplicate role.
    $duplicate_role_warning = t('The machine-readable name is already in use. It must be unique.');
    $this->backdropPost('admin/config/people/roles/add', $edit, t('Save and set permissions'));
    $this->assertRaw($duplicate_role_warning, 'Duplicate role warning displayed.');
    $this->backdropPost('admin/config/people/roles/add', $edit, t('Save role'));
    $this->assertRaw($duplicate_role_warning, 'Duplicate role warning displayed.');

    // Test renaming an existing role.
    $old_label = $role1->label;
    $new_label = '789';
    $new_description = 'Help text for 789 role. <strong>Bold text.</strong>. <xss>Stripped tag</xss>.';
    $edit = array(
      'label' => $new_label,
      'description' => $new_description,
    );
    $this->backdropPost("admin/config/people/roles/configure/$role1_name", $edit, t('Save role'));
    $this->assertText(t('The 789 role has been saved.'), 'The role has been renamed.');
    $this->assertUrl('admin/config/people/roles', array(), 'Redirected to correct URL after clicking the renaming the role.');
    backdrop_static_reset('user_roles');
    $role1 = user_role_load($role1_name);
    $this->assertFalse($role1->label === $old_label, 'The role has had its label changed.');
    $this->assertTrue($role1->label === $new_label, 'The role has the new label.');
    $this->assertTrue($role1->description === $new_description, 'The role has the new description (help text).');

    // Confirm description (help text) is shown editing a user.
    $this->backdropGet('user/' . $this->admin_user->uid . '/edit');
    $this->assertRaw(filter_xss_admin($new_description));

    // Make sure that the system-defined roles can still be edited, to adjust
    // their labels and descriptions.
    $this->backdropGet('admin/config/people/roles/configure/' . BACKDROP_ANONYMOUS_ROLE);
    $this->assertResponse(200, 'Access granted when trying to edit the built-in anonymous role.');
    $this->assertText(t('Description'));
    // Help text is hidden for the anonymous role, since it is never assigned.
    $this->assertNoText(t('Help text'));
    $this->backdropGet('admin/config/people/roles/configure/' . BACKDROP_AUTHENTICATED_ROLE);
    $this->assertText(t('Description'));
    $this->assertResponse(200, 'Access granted when trying to edit the built-in authenticated role.');

    // Create a default role for site administrators, with all available
    // permissions assigned.
    $admin_role = new stdClass();
    $admin_role->name = 'administrator';
    $admin_role->label = st('Administrator');
    $admin_role->weight = 2;
    $admin_role->permissions = array_keys(module_invoke_all('permission'));
    user_role_save($admin_role);
    // Set this as the administrator role.
    config_set('system.core', 'user_admin_role', $admin_role->name);

    $role_name = 'administrator';
    $role = user_role_load($role_name);

    // Test canceling the various actions that can be performed on user roles.
    $actions = array('configure', 'delete');
    foreach ($actions as $action) {
      $this->backdropGet("admin/config/people/roles/$action/$role_name");
      $this->clickLink(t('Cancel'));
      $this->assertResponse(200);
      $this->assertUrl('admin/config/people/roles', array(), "Redirected to correct URL after canceling $action role.");
    }

    // Test deleting the default administrator role.
    $this->backdropPost("admin/config/people/roles/delete/$role_name", array(), t('Delete'));
    $this->assertText(t('The administrator role has been deleted.'), 'The role has been deleted');
    $this->assertNoLinkByHref("admin/config/people/roles/configure/$role_name", 'Role edit link removed.');
    backdrop_static_reset('user_roles');
    $this->assertFalse(user_role_load($role_name), 'A deleted role can no longer be loaded.');
    // Since the administrator role that was previously set as admin has been
    // deleted, no role should be set as admin now.
    $this->assertFalse(config_get('system.core', 'user_admin_role'), 'No role is configured as the administrator role.');
  }

  /**
   * Test user role weight change operation.
   */
  function testRoleWeightChange() {
    $this->backdropLogin($this->admin_user);

    // Pick up a role and get its weight.
    $role_name = $this->admin_user->roles[count($this->admin_user->roles) - 1];
    $role = user_role_load($role_name);
    $old_weight = $role->weight;

    // Change the role weight and submit the form.
    $edit = array('roles['. $role_name .'][weight]' => $old_weight + 1);
    $this->backdropPost('admin/config/people/roles', $edit, t('Save configuration'));
    $this->assertText(t('The role settings have been updated.'), 'The role settings form submitted successfully.');

    // Retrieve the saved role and compare its weight.
    backdrop_static_reset('user_roles');
    $role = user_role_load($role_name);
    $new_weight = $role->weight;
    $this->assertTrue(($old_weight + 1) == $new_weight, 'Role weight updated successfully.');
  }
}

/**
 * Test user token replacement in strings.
 */
class UserTokenReplaceTestCase extends BackdropWebTestCase {
  protected $profile = 'testing';

  /**
   * Creates a user, then tests the tokens generated from it.
   */
  function testUserTokenReplacement() {
    global $language;
    $url_options = array(
      'absolute' => TRUE,
      'language' => $language,
    );

    // Create two users and log them in one after another.
    $user1 = $this->backdropCreateUser(array());
    $user2 = $this->backdropCreateUser(array());
    $this->backdropLogin($user1);
    $this->backdropLogout();
    $this->backdropLogin($user2);

    $account = user_load($user1->uid);
    $global_account = user_load($GLOBALS['user']->uid);

    // Generate and test sanitized tokens.
    $tests = array();
    $tests['[user:uid]'] = $account->uid;
    $tests['[user:name]'] = check_plain(user_format_name($account));
    $tests['[user:mail]'] = check_plain($account->mail);
    $tests['[user:url]'] = url("user/$account->uid", $url_options);
    $tests['[user:edit-url]'] = url("user/$account->uid/edit", $url_options);
    $tests['[user:last-login]'] = format_date($account->login, 'medium', '', NULL, $language->langcode);
    $tests['[user:last-login:short]'] = format_date($account->login, 'short', '', NULL, $language->langcode);
    $tests['[user:created]'] = format_date($account->created, 'medium', '', NULL, $language->langcode);
    $tests['[user:created:short]'] = format_date($account->created, 'short', '', NULL, $language->langcode);
    $tests['[user:changed]'] = format_date($account->changed, 'medium', '', NULL, $language->langcode);
    $tests['[user:changed:short]'] = format_date($account->changed, 'short', '', NULL, $language->langcode);
    $tests['[current-user:name]'] = check_plain(user_format_name($global_account));

    // Test to make sure that we generated something for each token.
    $this->assertFalse(in_array(0, array_map('strlen', $tests)), 'No empty tokens generated.');

    foreach ($tests as $input => $expected) {
      $output = token_replace($input, array('user' => $account), array('language' => $language));
      $this->assertEqual($output, $expected, format_string('Sanitized user token %token replaced.', array('%token' => $input)));
    }

    // Generate and test unsanitized tokens.
    $tests['[user:name]'] = user_format_name($account);
    $tests['[user:mail]'] = $account->mail;
    $tests['[current-user:name]'] = user_format_name($global_account);

    foreach ($tests as $input => $expected) {
      $output = token_replace($input, array('user' => $account), array('language' => $language, 'sanitize' => FALSE));
      $this->assertEqual($output, $expected, format_string('Unsanitized user token %token replaced.', array('%token' => $input)));
    }
  }
}

/**
 * Test user search.
 */
class UserUserSearchTestCase extends BackdropWebTestCase {
  protected $profile = 'testing';

  function setUp() {
    parent::setUp(array('search'));
  }

  function testUserSearch() {
    // Verify that a user without 'administer users' permission cannot search
    // for users by email address. Additionally, ensure that the username has a
    // plus sign to ensure searching works with that.
    $user1 = $this->backdropCreateUser(array('access user profiles', 'search content', 'use advanced search'));
    $user1->name = $edit['name'] = 'foo+bar';
    $user1->mail = $edit['mail'] = $edit['name'] . '@example.com';
    user_save($user1);
    $this->backdropLogin($user1);
    $keys = $user1->mail;
    $edit = array('keys' => $keys);
    $this->backdropPost('search/user/', $edit, t('Search'));
    $this->assertNoText($keys);
    $this->backdropLogout();

    $user2 = $this->backdropCreateUser(array('administer users', 'access user profiles', 'search content', 'use advanced search'));
    $this->backdropLogin($user2);
    $keys = $user2->mail;
    $edit = array('keys' => $keys);
    $this->backdropPost('search/user/', $edit, t('Search'));
    $this->assertText($keys);

    // Verify that wildcard search works.
    $keys = $user1->name;
    $keys = substr($keys, 0, 2) . '*' . substr($keys, 4, 2);
    $edit = array('keys' => $keys);
    $this->backdropPost('search/user/', $edit, t('Search'));
    $this->assertText($user1->name, 'Search for username wildcard resulted in user name on page for administrative user.');

    // Verify that wildcard search works for email.
    $keys = $user1->mail;
    $keys = substr($keys, 0, 2) . '*' . substr($keys, 4, 2);
    $edit = array('keys' => $keys);
    $this->backdropPost('search/user/', $edit, t('Search'));
    $this->assertText($user1->name, 'Search for email wildcard resulted in user name on page for administrative user.');

    // Create a blocked user.
    $blocked_user = $this->backdropCreateUser();
    $blocked_user->status = 0;
    $blocked_user->save();

    // Verify that users with "administer users" permissions can see blocked
    // accounts in search results.
    $edit = array('keys' => $blocked_user->name);
    $this->backdropPost('search/user', $edit, t('Search'));
    $this->assertText($blocked_user->name, 'Blocked users are listed on the user search results for users with the "administer users" permission.');

    // Verify that users without "administer users" permissions do not see
    // blocked accounts in search results.
    $this->backdropLogin($user1);
    $edit = array('keys' => $blocked_user->name);
    $this->backdropPost('search/user/', $edit, t('Search'));
    $this->assertNoText($blocked_user->name, 'Blocked users are hidden from the user search results.');

    $this->backdropLogout();
  }
}

/**
 * Test role assignment.
 */
class UserRolesAssignmentTestCase extends BackdropWebTestCase {
  protected $profile = 'testing';
  protected $admin_user;

  function setUp() {
    parent::setUp();
    $this->admin_user = $this->backdropCreateUser(array(
      'administer permissions',
      'assign roles',
      'administer users',
    ));
    $this->backdropLogin($this->admin_user);
  }

  /**
   * Tests that a user can be assigned a role and that the role can be removed
   * again.
   */
  function testAssignAndRemoveRole()  {
    $role_name = $this->backdropCreateRole(array('administer content types'));
    $account = $this->backdropCreateUser();

    // Assign the role to the user.
    $this->backdropPost('user/' . $account->uid . '/edit', array("roles[$role_name]" => $role_name), t('Save'));
    $this->assertText(t('The changes have been saved.'));
    $this->backdropGet('user/' . $account->uid . '/edit');
    $this->assertFieldChecked('edit-roles-' . strtolower($role_name), 'Role is assigned.');
    $this->userLoadAndCheckRoleAssigned($account, $role_name);

    // Remove the role from the user.
    $this->backdropPost('user/' . $account->uid . '/edit', array("roles[$role_name]" => FALSE), t('Save'));
    $this->assertText(t('The changes have been saved.'));
    $this->backdropGet('user/' . $account->uid . '/edit');
    $this->assertNoFieldChecked('edit-roles-' . strtolower($role_name), 'Role is removed from user.');
    $this->userLoadAndCheckRoleAssigned($account, $role_name, FALSE);
  }

  /**
   * Tests that when creating a user the role can be assigned. And that it can
   * be removed again.
   */
  function testCreateUserWithRole() {
    $role_name = $this->backdropCreateRole(array('administer content types'));
    // Create a new user and add the role at the same time.
    $edit = array(
      'name' => $this->randomName(),
      'mail' => $this->randomName() . '@example.com',
      'pass' => $pass = $this->randomString(),
      'notify' => FALSE,
      "roles[$role_name]" => $role_name,
    );
    $this->backdropPost('admin/people/create', $edit, t('Create new account'));
    $this->assertText(t('Created a new user account for !name.', array('!name' => $edit['name'])));
    // Get the newly added user.
    $account = user_load_by_name($edit['name']);

    $this->backdropGet('user/' . $account->uid . '/edit');
    $this->assertFieldChecked('edit-roles-' . strtolower($role_name), 'Role is assigned.');
    $this->userLoadAndCheckRoleAssigned($account, $role_name);

    // Remove the role again.
    $this->backdropPost('user/' . $account->uid . '/edit', array("roles[$role_name]" => FALSE), t('Save'));
    $this->assertText(t('The changes have been saved.'));
    $this->backdropGet('user/' . $account->uid . '/edit');
    $this->assertNoFieldChecked('edit-roles-' . strtolower($role_name), 'Role is removed from user.');
    $this->userLoadAndCheckRoleAssigned($account, $role_name, FALSE);
  }

  /**
   * Check role on user object.
   *
   * @param object $account User.
   * @param integer $role_name Role name.
   * @param bool $is_assigned True if the role should present on the account.
   */
  private function userLoadAndCheckRoleAssigned($account, $role_name, $is_assigned = TRUE) {
    $account = user_load($account->uid, TRUE);
    if ($is_assigned) {
      $this->assertTrue(in_array($role_name, $account->roles), 'The role is present in the user object.');
    }
    else {
      $this->assertFalse(in_array($role_name, $account->roles), 'The role is not present in the user object.');
    }
  }
}

/**
 * Tests user_validate_current_pass on a custom form.
 */
class UserValidateCurrentPassCustomForm extends BackdropWebTestCase {
  protected $profile = 'testing';

  /**
   * User with permission to view content.
   */
  protected $accessUser;

  /**
   * User permission to administer users.
   */
  protected $adminUser;

  function setUp() {
    parent::setUp('user_form_test');
    // Create two users
    $this->accessUser = $this->backdropCreateUser(array('access content'));
    $this->adminUser = $this->backdropCreateUser(array('administer users'));
  }

  /**
   * Tests that user_validate_current_pass can be reused on a custom form.
   */
  function testUserValidateCurrentPassCustomForm() {
    $this->backdropLogin($this->adminUser);

    // Check that filling out a single password field does not validate.
    $edit = array();
    $edit['password_confirm[pass1]'] = '';
    $edit['password_confirm[pass2]'] = $this->randomName();
    $this->backdropPost('user_form_test_current_password/' . $this->accessUser->uid, $edit, t('Test'));
    $this->assertText(t("The specified passwords do not match."), 'Typing mismatched passwords displays an error message.');

    $edit['password_confirm[pass1]'] = $new_pass = $this->randomName();
    $edit['password_confirm[pass2]'] = '';
    $this->backdropPost('user_form_test_current_password/' . $this->accessUser->uid, $edit, t('Test'));
    $this->assertText(t("The specified passwords do not match."), 'Typing mismatched passwords displays an error message.');

    // Submit the custom form with the admin user using the access user's password.
    $edit = array();
    $edit['user_form_test_field'] = $this->accessUser->name;
    $edit['current_pass'] = $this->accessUser->pass_raw;
    $edit['password_confirm[pass1]'] = $new_pass;
    $edit['password_confirm[pass2]'] = $new_pass;
    $this->backdropPost('user_form_test_current_password/' . $this->accessUser->uid, $edit, t('Test'));
    $this->assertText(t('The password has been validated and the form submitted successfully.'));
  }
}

/**
 * Test user entity callbacks.
 */
class UserEntityCallbacksTestCase extends BackdropWebTestCase {
  protected $profile = 'testing';

  /**
   * @var User
   */
  protected $account;

  /**
   * @var AnonymousUser
   */
  protected $anonymous;

  function setUp() {
    parent::setUp();
    $this->account = $this->backdropCreateUser();
    $this->anonymous = backdrop_anonymous_user();
  }

  /**
   * Test label callback.
   */
  function testLabelCallback() {
    $this->assertEqual(entity_label('user', $this->account), $this->account->name, t('The username should be used as label'));

    // Setup a random anonymous name to be sure the name is used.
    $name = $this->randomName();
    config_set('system.core', 'anonymous', $name);
    $this->assertEqual(entity_label('user', $this->anonymous), $name, t('The variable anonymous should be used for name of uid 0'));
  }

  /**
   * Test URI callback.
   */
  function testUriCallback() {
    $uri = entity_uri('user', $this->account);
    $this->assertEqual('user/' . $this->account->uid, $uri['path'], t('Correct user URI.'));
  }
}