wiki.techinc.nl/tests/phpunit/includes/api/ApiOptionsTest.php
Catrope fe45ba8752 (bug 42202) Validate preference values in action=options
Previously, there was no validation whatsoever and the module would
happily write any preference you asked it to. This, combined with the
fact that the code using the 'editfont' preference didn't perform any
validation or escaping, led to a CSS injection vulnerability.

Using Preferences::getPreferences breaks some existing test cases
because a MockUser doesn't have groups for preferences.

Change-Id: I98df55f2b16ac1b6fce578798b6f58b5dad96775
2012-11-29 16:42:56 -08:00

227 lines
5.8 KiB
PHP

<?php
/**
* @group API
*/
class ApiOptionsTest extends MediaWikiLangTestCase {
private $mTested, $mUserMock, $mContext, $mSession;
private static $Success = array( 'options' => 'success' );
protected function setUp() {
parent::setUp();
$this->mUserMock = $this->getMockBuilder( 'User' )
->disableOriginalConstructor()
->getMock();
// Create a new context
$this->mContext = new DerivativeContext( new RequestContext() );
$this->mContext->setUser( $this->mUserMock );
$main = new ApiMain( $this->mContext );
// Empty session
$this->mSession = array();
$this->mTested = new ApiOptions( $main, 'options' );
}
private function getSampleRequest( $custom = array() ) {
$request = array(
'token' => '123ABC',
'change' => null,
'optionname' => null,
'optionvalue' => null,
);
return array_merge( $request, $custom );
}
private function executeQuery( $request ) {
$this->mContext->setRequest( new FauxRequest( $request, true, $this->mSession ) );
$this->mTested->execute();
return $this->mTested->getResult()->getData();
}
/**
* @expectedException UsageException
*/
public function testNoToken() {
$request = $this->getSampleRequest( array( 'token' => null ) );
$this->executeQuery( $request );
}
public function testAnon() {
$this->mUserMock->expects( $this->once() )
->method( 'isAnon' )
->will( $this->returnValue( true ) );
try {
$request = $this->getSampleRequest();
$this->executeQuery( $request );
} catch ( UsageException $e ) {
$this->assertEquals( 'notloggedin', $e->getCodeString() );
$this->assertEquals( 'Anonymous users cannot change preferences', $e->getMessage() );
return;
}
$this->fail( "UsageException was not thrown" );
}
public function testNoOptionname() {
try {
$request = $this->getSampleRequest( array( 'optionvalue' => '1' ) );
$this->executeQuery( $request );
} catch ( UsageException $e ) {
$this->assertEquals( 'nooptionname', $e->getCodeString() );
$this->assertEquals( 'The optionname parameter must be set', $e->getMessage() );
return;
}
$this->fail( "UsageException was not thrown" );
}
public function testNoChanges() {
$this->mUserMock->expects( $this->never() )
->method( 'resetOptions' );
$this->mUserMock->expects( $this->never() )
->method( 'setOption' );
$this->mUserMock->expects( $this->never() )
->method( 'saveSettings' );
try {
$request = $this->getSampleRequest();
$this->executeQuery( $request );
} catch ( UsageException $e ) {
$this->assertEquals( 'nochanges', $e->getCodeString() );
$this->assertEquals( 'No changes were requested', $e->getMessage() );
return;
}
$this->fail( "UsageException was not thrown" );
}
/**
* @group Broken
*/
public function testReset() {
$this->mUserMock->expects( $this->once() )
->method( 'resetOptions' );
$this->mUserMock->expects( $this->never() )
->method( 'setOption' );
$this->mUserMock->expects( $this->once() )
->method( 'saveSettings' );
$request = $this->getSampleRequest( array( 'reset' => '' ) );
$response = $this->executeQuery( $request );
$this->assertEquals( self::$Success, $response );
}
/**
* @group Broken
*/
public function testOptionWithValue() {
$this->mUserMock->expects( $this->never() )
->method( 'resetOptions' );
$this->mUserMock->expects( $this->once() )
->method( 'setOption' )
->with( $this->equalTo( 'name' ), $this->equalTo( 'value' ) );
$this->mUserMock->expects( $this->once() )
->method( 'saveSettings' );
$request = $this->getSampleRequest( array( 'optionname' => 'name', 'optionvalue' => 'value' ) );
$response = $this->executeQuery( $request );
$this->assertEquals( self::$Success, $response );
}
/**
* @group Broken
*/
public function testOptionResetValue() {
$this->mUserMock->expects( $this->never() )
->method( 'resetOptions' );
$this->mUserMock->expects( $this->once() )
->method( 'setOption' )
->with( $this->equalTo( 'name' ), $this->equalTo( null ) );
$this->mUserMock->expects( $this->once() )
->method( 'saveSettings' );
$request = $this->getSampleRequest( array( 'optionname' => 'name' ) );
$response = $this->executeQuery( $request );
$this->assertEquals( self::$Success, $response );
}
/**
* @group Broken
*/
public function testChange() {
$this->mUserMock->expects( $this->never() )
->method( 'resetOptions' );
$this->mUserMock->expects( $this->at( 1 ) )
->method( 'setOption' )
->with( $this->equalTo( 'willBeNull' ), $this->equalTo( null ) );
$this->mUserMock->expects( $this->at( 2 ) )
->method( 'setOption' )
->with( $this->equalTo( 'willBeEmpty' ), $this->equalTo( '' ) );
$this->mUserMock->expects( $this->at( 3 ) )
->method( 'setOption' )
->with( $this->equalTo( 'willBeHappy' ), $this->equalTo( 'Happy' ) );
$this->mUserMock->expects( $this->once() )
->method( 'saveSettings' );
$request = $this->getSampleRequest( array( 'change' => 'willBeNull|willBeEmpty=|willBeHappy=Happy' ) );
$response = $this->executeQuery( $request );
$this->assertEquals( self::$Success, $response );
}
/**
* @group Broken
*/
public function testResetChangeOption() {
$this->mUserMock->expects( $this->once() )
->method( 'resetOptions' );
$this->mUserMock->expects( $this->at( 2 ) )
->method( 'setOption' )
->with( $this->equalTo( 'willBeHappy' ), $this->equalTo( 'Happy' ) );
$this->mUserMock->expects( $this->at( 3 ) )
->method( 'setOption' )
->with( $this->equalTo( 'name' ), $this->equalTo( 'value' ) );
$this->mUserMock->expects( $this->once() )
->method( 'saveSettings' );
$args = array(
'reset' => '',
'change' => 'willBeHappy=Happy',
'optionname' => 'name',
'optionvalue' => 'value'
);
$response = $this->executeQuery( $this->getSampleRequest( $args ) );
$this->assertEquals( self::$Success, $response );
}
}