3d0b4fea3d
AuthManager is coming, which will make it easier to add alternative methods of authentication. But in order to do that, we need to finally get around to ripping the password-related bits out of the User class. The password expiration handling isn't used anywhere in core or extensions in Gerrit beyond testing for expired passwords on login and resetting the expiry date on password change. Those bits have been inlined and the functions removed; AuthManager will allow each "authentication provider" to handle its own password expiration. The methods for fetching passwords, including the fact that mPassword and other fields are public, has also been removed. This is already broken in combination with basically any extension that messes with authentication, and the major use outside of that was in creating system users like MassMessage's "MediaWiki message delivery" user. Password setting methods are silently deprecated, since most of the replacements won't be available until AuthManager. But uses in unit testing can be replaced with TestUser::setPasswordForUser() immediately. User::randomPassword() and User::getPasswordFactory() don't really belong in User either. For the former a new PasswordFactory method has been created, while the latter should just be replaced by the two lines to create a PasswordFactory via its constructor. Bug: T47716 Change-Id: I2c736ad72d946fa9b859e6cd335fa58aececc0d5
83 lines
2 KiB
PHP
83 lines
2 KiB
PHP
<?php
|
|
|
|
/**
|
|
* @group API
|
|
* @group Database
|
|
* @group medium
|
|
*
|
|
* @covers ApiBlock
|
|
*/
|
|
class ApiBlockTest extends ApiTestCase {
|
|
protected function setUp() {
|
|
parent::setUp();
|
|
$this->doLogin();
|
|
}
|
|
|
|
protected function getTokens() {
|
|
return $this->getTokenList( self::$users['sysop'] );
|
|
}
|
|
|
|
function addDBData() {
|
|
$user = User::newFromName( 'UTApiBlockee' );
|
|
|
|
if ( $user->getId() == 0 ) {
|
|
$user->addToDatabase();
|
|
TestUser::setPasswordForUser( $user, 'UTApiBlockeePassword' );
|
|
|
|
$user->saveSettings();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* This test has probably always been broken and use an invalid token
|
|
* Bug tracking brokenness is https://phabricator.wikimedia.org/T37646
|
|
*
|
|
* Root cause is https://gerrit.wikimedia.org/r/3434
|
|
* Which made the Block/Unblock API to actually verify the token
|
|
* previously always considered valid (T36212).
|
|
*/
|
|
public function testMakeNormalBlock() {
|
|
$tokens = $this->getTokens();
|
|
|
|
$user = User::newFromName( 'UTApiBlockee' );
|
|
|
|
if ( !$user->getId() ) {
|
|
$this->markTestIncomplete( "The user UTApiBlockee does not exist" );
|
|
}
|
|
|
|
if ( !array_key_exists( 'blocktoken', $tokens ) ) {
|
|
$this->markTestIncomplete( "No block token found" );
|
|
}
|
|
|
|
$this->doApiRequest( array(
|
|
'action' => 'block',
|
|
'user' => 'UTApiBlockee',
|
|
'reason' => 'Some reason',
|
|
'token' => $tokens['blocktoken'] ), null, false, self::$users['sysop']->getUser() );
|
|
|
|
$block = Block::newFromTarget( 'UTApiBlockee' );
|
|
|
|
$this->assertTrue( !is_null( $block ), 'Block is valid' );
|
|
|
|
$this->assertEquals( 'UTApiBlockee', (string)$block->getTarget() );
|
|
$this->assertEquals( 'Some reason', $block->mReason );
|
|
$this->assertEquals( 'infinity', $block->mExpiry );
|
|
}
|
|
|
|
/**
|
|
* @expectedException UsageException
|
|
* @expectedExceptionMessage The token parameter must be set
|
|
*/
|
|
public function testBlockingActionWithNoToken() {
|
|
$this->doApiRequest(
|
|
array(
|
|
'action' => 'block',
|
|
'user' => 'UTApiBlockee',
|
|
'reason' => 'Some reason',
|
|
),
|
|
null,
|
|
false,
|
|
self::$users['sysop']->getUser()
|
|
);
|
|
}
|
|
}
|