8e3bcb67f4
This implements getWebUITokenSalt(), as mentioned in T25227#2008199 and implemented in F3328897. Somehow it didn't make it into Icb674095. This also fixes some issues in the unit test: * Properly link the user to the request's Session so User::doLogout() won't log a warning. This also gives use to the otherwise-unneeded implementation of setUp(), and lets us get rid of the broken call to User::newFromId() that was passing an IP address rather than a user ID. * Privatize some internal methods. * Use setExpectedApiException() instead of manually catching and hard-coding the English exception message. * Also assert that the bad token error didn't result in a logout. Bug: T25227 Change-Id: I2aecfba821cca3c367c5e7e8d188a88197fb82d2
75 lines
1.7 KiB
PHP
75 lines
1.7 KiB
PHP
<?php
|
|
|
|
/**
|
|
* @group API
|
|
* @group Database
|
|
* @group medium
|
|
*
|
|
* @covers ApiLogout
|
|
*/
|
|
class ApiLogoutTest extends ApiTestCase {
|
|
|
|
protected function setUp() {
|
|
global $wgRequest, $wgUser;
|
|
|
|
parent::setUp();
|
|
|
|
// Link the user to the Session properly so User::doLogout() doesn't complain.
|
|
$wgRequest->getSession()->setUser( $wgUser );
|
|
$wgUser = User::newFromSession( $wgRequest );
|
|
$this->apiContext->setUser( $wgUser );
|
|
}
|
|
|
|
public function testUserLogoutBadToken() {
|
|
global $wgUser;
|
|
|
|
$this->setExpectedApiException( 'apierror-badtoken' );
|
|
|
|
try {
|
|
$token = 'invalid token';
|
|
$this->doUserLogout( $token );
|
|
} finally {
|
|
$this->assertTrue( $wgUser->isLoggedIn(), 'not logged out' );
|
|
}
|
|
}
|
|
|
|
public function testUserLogout() {
|
|
global $wgUser;
|
|
|
|
$this->assertTrue( $wgUser->isLoggedIn(), 'sanity check' );
|
|
$token = $this->getUserCsrfTokenFromApi();
|
|
$this->doUserLogout( $token );
|
|
$this->assertFalse( $wgUser->isLoggedIn() );
|
|
}
|
|
|
|
public function testUserLogoutWithWebToken() {
|
|
global $wgUser, $wgRequest;
|
|
|
|
$this->assertTrue( $wgUser->isLoggedIn(), 'sanity check' );
|
|
|
|
// Logic copied from SkinTemplate.
|
|
$token = $wgUser->getEditToken( 'logoutToken', $wgRequest );
|
|
|
|
$this->doUserLogout( $token );
|
|
$this->assertFalse( $wgUser->isLoggedIn() );
|
|
}
|
|
|
|
private function getUserCsrfTokenFromApi() {
|
|
$retToken = $this->doApiRequest( [
|
|
'action' => 'query',
|
|
'meta' => 'tokens',
|
|
'type' => 'csrf'
|
|
] );
|
|
|
|
$this->assertArrayNotHasKey( 'warnings', $retToken );
|
|
|
|
return $retToken[0]['query']['tokens']['csrftoken'];
|
|
}
|
|
|
|
private function doUserLogout( $logoutToken ) {
|
|
return $this->doApiRequest( [
|
|
'action' => 'logout',
|
|
'token' => $logoutToken
|
|
] );
|
|
}
|
|
}
|