<?php

/**

 * @file

 * Tests for user.module.

 */

class UserRegistrationTestCase extends DrupalWebTestCase {

  public static function getInfo() {

    return array(

      'name' => 'User registration',

      'description' => 'Test registration of user under different configurations.',

      'group' => 'User'

    );

  }

  function setUp() {

    parent::setUp('field_test');

  }

  function testRegistrationWithEmailVerification() {

    // Require e-mail verification.

    variable_set('user_email_verification', TRUE);

    // Set registration to administrator only.

    variable_set('user_register', USER_REGISTER_ADMINISTRATORS_ONLY);

    $this->drupalGet('user/register');

    $this->assertResponse(403, 'Registration page is inaccessible when only administrators can create accounts.');

    // Allow registration by site visitors without administrator approval.

    variable_set('user_register', USER_REGISTER_VISITORS);

    $edit = array();

    $edit['name'] = $name = $this->randomName();

    $edit['mail'] = $mail = $edit['name'] . '@example.com';

    $this->drupalPost('user/register', $edit, t('Create new account'));

    $this->assertText(t('A welcome message with further instructions has been sent to your e-mail address.'), 'User registered successfully.');

    $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

    $new_user = reset($accounts);

    $this->assertTrue($new_user->status, 'New account is active after registration.');

    // Allow registration by site visitors, but require administrator approval.

    variable_set('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL);

    $edit = array();

    $edit['name'] = $name = $this->randomName();

    $edit['mail'] = $mail = $edit['name'] . '@example.com';

    $this->drupalPost('user/register', $edit, t('Create new account'));

    $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

    $new_user = reset($accounts);

    $this->assertFalse($new_user->status, 'New account is blocked until approved by an administrator.');

  }

  function testRegistrationWithoutEmailVerification() {

    // Don't require e-mail verification.

    variable_set('user_email_verification', FALSE);

    // Allow registration by site visitors without administrator approval.

    variable_set('user_register', USER_REGISTER_VISITORS);

    $edit = array();

    $edit['name'] = $name = $this->randomName();

    $edit['mail'] = $mail = $edit['name'] . '@example.com';

    // Try entering a mismatching password.

    $edit['pass[pass1]'] = '99999.0';

    $edit['pass[pass2]'] = '99999';

    $this->drupalPost('user/register', $edit, t('Create new account'));

    $this->assertText(t('The specified passwords do not match.'), 'Typing mismatched passwords displays an error message.');

    // Enter a correct password.

    $edit['pass[pass1]'] = $new_pass = $this->randomName();

    $edit['pass[pass2]'] = $new_pass;

    $this->drupalPost('user/register', $edit, t('Create new account'));

    $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

    $new_user = reset($accounts);

    $this->assertText(t('Registration successful. You are now logged in.'), 'Users are logged in after registering.');

    $this->drupalLogout();

    // Allow registration by site visitors, but require administrator approval.

    variable_set('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL);

    $edit = array();

    $edit['name'] = $name = $this->randomName();

    $edit['mail'] = $mail = $edit['name'] . '@example.com';

    $edit['pass[pass1]'] = $pass = $this->randomName();

    $edit['pass[pass2]'] = $pass;

    $this->drupalPost('user/register', $edit, t('Create new account'));

    $this->assertText(t('Thank you for applying for an account. Your account is currently pending approval by the site administrator.'), 'Users are notified of pending approval');

    // Try to login before administrator approval.

    $auth = array(

      'name' => $name,

      'pass' => $pass,

    );

    $this->drupalPost('user/login', $auth, t('Log in'));

    $this->assertText(t('The username @name has not been activated or is blocked.', array('@name' => $name)), 'User cannot login yet.');

    // Activate the new account.

    $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

    $new_user = reset($accounts);

    $admin_user = $this->drupalCreateUser(array('administer users'));

    $this->drupalLogin($admin_user);

    $edit = array(

      'status' => 1,

    );

    $this->drupalPost('user/' . $new_user->uid . '/edit', $edit, t('Save'));

    $this->drupalLogout();

    // Login after administrator approval.

    $this->drupalPost('user/login', $auth, t('Log in'));

    $this->assertText(t('Member for'), 'User can log in after administrator approval.');

  }

  function testRegistrationEmailDuplicates() {

    // Don't require e-mail verification.

    variable_set('user_email_verification', FALSE);

    // Allow registration by site visitors without administrator approval.

    variable_set('user_register', USER_REGISTER_VISITORS);

    // Set up a user to check for duplicates.

    $duplicate_user = $this->drupalCreateUser();

    $edit = array();

    $edit['name'] = $this->randomName();

    $edit['mail'] = $duplicate_user->mail;

    // Attempt to create a new account using an existing e-mail address.

    $this->drupalPost('user/register', $edit, t('Create new account'));

    $this->assertText(t('The e-mail address @email is already registered.', array('@email' => $duplicate_user->mail)), 'Supplying an exact duplicate email address displays an error message');

    // Attempt to bypass duplicate email registration validation by adding spaces.

    $edit['mail'] = '   ' . $duplicate_user->mail . '   ';

    $this->drupalPost('user/register', $edit, t('Create new account'));

    $this->assertText(t('The e-mail address @email is already registered.', array('@email' => $duplicate_user->mail)), 'Supplying a duplicate email address with added whitespace displays an error message');

  }

  function testRegistrationDefaultValues() {

    // Allow registration by site visitors without administrator approval.

    variable_set('user_register', USER_REGISTER_VISITORS);

    // Don't require e-mail verification.

    variable_set('user_email_verification', FALSE);

    // Set the default timezone to Brussels.

    variable_set('configurable_timezones', 1);

    variable_set('date_default_timezone', 'Europe/Brussels');

    // Check that the account information fieldset's options are not displayed

    // is a fieldset if there is not more than one fieldset in the form.

    $this->drupalGet('user/register');

    $this->assertNoRaw('<fieldset id="edit-account"><legend>Account information</legend>', 'Account settings fieldset was hidden.');

    $edit = array();

    $edit['name'] = $name = $this->randomName();

    $edit['mail'] = $mail = $edit['name'] . '@example.com';

    $edit['pass[pass1]'] = $new_pass = $this->randomName();

    $edit['pass[pass2]'] = $new_pass;

    $this->drupalPost(NULL, $edit, t('Create new account'));

    // Check user fields.

    $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

    $new_user = reset($accounts);

    $this->assertEqual($new_user->name, $name, 'Username matches.');

    $this->assertEqual($new_user->mail, $mail, 'E-mail address matches.');

    $this->assertEqual($new_user->theme, '', 'Correct theme field.');

    $this->assertEqual($new_user->signature, '', 'Correct signature field.');

    $this->assertTrue(($new_user->created > REQUEST_TIME - 20 ), 'Correct creation time.');

    $this->assertEqual($new_user->status, variable_get('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL) == USER_REGISTER_VISITORS ? 1 : 0, 'Correct status field.');

    $this->assertEqual($new_user->timezone, variable_get('date_default_timezone'), 'Correct time zone field.');

    $this->assertEqual($new_user->language, '', 'Correct language field.');

    $this->assertEqual($new_user->picture, '', 'Correct picture field.');

    $this->assertEqual($new_user->init, $mail, 'Correct init field.');

  }

  /**

   * Tests Field API fields on user registration forms.

   */

  function testRegistrationWithUserFields() {

    // Create a field, and an instance on 'user' entity type.

    $field = array(

      'type' => 'test_field',

      'field_name' => 'test_user_field',

      'cardinality' => 1,

    );

    field_create_field($field);

    $instance = array(

      'field_name' => 'test_user_field',

      'entity_type' => 'user',

      'label' => 'Some user field',

      'bundle' => 'user',

      'required' => TRUE,

      'settings' => array('user_register_form' => FALSE),

    );

    field_create_instance($instance);

    // Check that the field does not appear on the registration form.

    $this->drupalGet('user/register');

    $this->assertNoText($instance['label'], 'The field does not appear on user registration form');

    // Have the field appear on the registration form.

    $instance['settings']['user_register_form'] = TRUE;

    field_update_instance($instance);

    $this->drupalGet('user/register');

    $this->assertText($instance['label'], 'The field appears on user registration form');

    // Check that validation errors are correctly reported.

    $edit = array();

    $edit['name'] = $name = $this->randomName();

    $edit['mail'] = $mail = $edit['name'] . '@example.com';

    // Missing input in required field.

    $edit['test_user_field[und][0][value]'] = '';

    $this->drupalPost(NULL, $edit, t('Create new account'));

    $this->assertRaw(t('@name field is required.', array('@name' => $instance['label'])), 'Field validation error was correctly reported.');

    // Invalid input.

    $edit['test_user_field[und][0][value]'] = '-1';

    $this->drupalPost(NULL, $edit, t('Create new account'));

    $this->assertRaw(t('%name does not accept the value -1.', array('%name' => $instance['label'])), 'Field validation error was correctly reported.');

    // Submit with valid data.

    $value = rand(1, 255);

    $edit['test_user_field[und][0][value]'] = $value;

    $this->drupalPost(NULL, $edit, t('Create new account'));

    // Check user fields.

    $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

    $new_user = reset($accounts);

    $this->assertEqual($new_user->test_user_field[LANGUAGE_NONE][0]['value'], $value, 'The field value was correctly saved.');

    // Check that the 'add more' button works.

    $field['cardinality'] = FIELD_CARDINALITY_UNLIMITED;

    field_update_field($field);

    foreach (array('js', 'nojs') as $js) {

      $this->drupalGet('user/register');

      // Add two inputs.

      $value = rand(1, 255);

      $edit = array();

      $edit['test_user_field[und][0][value]'] = $value;

      if ($js == 'js') {

        $this->drupalPostAJAX(NULL, $edit, 'test_user_field_add_more');

        $this->drupalPostAJAX(NULL, $edit, 'test_user_field_add_more');

      }

      else {

        $this->drupalPost(NULL, $edit, t('Add another item'));

        $this->drupalPost(NULL, $edit, t('Add another item'));

      }

      // Submit with three values.

      $edit['test_user_field[und][1][value]'] = $value + 1;

      $edit['test_user_field[und][2][value]'] = $value + 2;

      $edit['name'] = $name = $this->randomName();

      $edit['mail'] = $mail = $edit['name'] . '@example.com';

      $this->drupalPost(NULL, $edit, t('Create new account'));

      // Check user fields.

      $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

      $new_user = reset($accounts);

      $this->assertEqual($new_user->test_user_field[LANGUAGE_NONE][0]['value'], $value, format_string('@js : The field value was correclty saved.', array('@js' => $js)));

      $this->assertEqual($new_user->test_user_field[LANGUAGE_NONE][1]['value'], $value + 1, format_string('@js : The field value was correclty saved.', array('@js' => $js)));

      $this->assertEqual($new_user->test_user_field[LANGUAGE_NONE][2]['value'], $value + 2, format_string('@js : The field value was correclty saved.', array('@js' => $js)));

    }

  }

}

class UserValidationTestCase extends DrupalWebTestCase {

  public static function getInfo() {

    return array(

      'name' => 'Username/e-mail validation',

      'description' => 'Verify that username/email validity checks behave as designed.',

      'group' => 'User'

    );

  }

  // Username validation.

  function testUsernames() {

    $test_cases = array( // '<username>' => array('<description>', 'assert<testName>'),

      'foo'                    => array('Valid username', 'assertNull'),

      'FOO'                    => array('Valid username', 'assertNull'),

      'Foo O\'Bar'             => array('Valid username', 'assertNull'),

      'foo@bar'                => array('Valid username', 'assertNull'),

      'foo@example.com'        => array('Valid username', 'assertNull'),

      'foo@-example.com'       => array('Valid username', 'assertNull'), // invalid domains are allowed in usernames

      'þòøÇߪř€'               => array('Valid username', 'assertNull'),

      'ᚠᛇᚻ᛫ᛒᛦᚦ'                => array('Valid UTF8 username', 'assertNull'), // runes

      ' foo'                   => array('Invalid username that starts with a space', 'assertNotNull'),

      'foo '                   => array('Invalid username that ends with a space', 'assertNotNull'),

      'foo  bar'               => array('Invalid username that contains 2 spaces \'  \'', 'assertNotNull'),

      ''                       => array('Invalid empty username', 'assertNotNull'),

      'foo/'                   => array('Invalid username containing invalid chars', 'assertNotNull'),

      'foo' . chr(0) . 'bar'   => array('Invalid username containing chr(0)', 'assertNotNull'), // NULL

      'foo' . chr(13) . 'bar'  => array('Invalid username containing chr(13)', 'assertNotNull'), // CR

      str_repeat('x', USERNAME_MAX_LENGTH + 1) => array('Invalid excessively long username', 'assertNotNull'),

    );

    foreach ($test_cases as $name => $test_case) {

      list($description, $test) = $test_case;

      $result = user_validate_name($name);

      $this->$test($result, $description . ' (' . $name . ')');

    }

  }

  // Mail validation. More extensive tests can be found at common.test

  function testMailAddresses() {

    $test_cases = array( // '<username>' => array('<description>', 'assert<testName>'),

      ''                => array('Empty mail address', 'assertNotNull'),

      'foo'             => array('Invalid mail address', 'assertNotNull'),

      'foo@example.com' => array('Valid mail address', 'assertNull'),

    );

    foreach ($test_cases as $name => $test_case) {

      list($description, $test) = $test_case;

      $result = user_validate_mail($name);

      $this->$test($result, $description . ' (' . $name . ')');

    }

  }

}

/**

 * Functional tests for user logins, including rate limiting of login attempts.

 */

class UserLoginTestCase extends DrupalWebTestCase {

  public static function getInfo() {

    return array(

      'name' => 'User login',

      'description' => 'Ensure that login works as expected.',

      'group' => 'User',

    );

  }

  /**

   * Test the global login flood control.

   */

  function testGlobalLoginFloodControl() {

    // Set the global login limit.

    variable_set('user_failed_login_ip_limit', 10);

    // Set a high per-user limit out so that it is not relevant in the test.

    variable_set('user_failed_login_user_limit', 4000);

    $user1 = $this->drupalCreateUser(array());

    $incorrect_user1 = clone $user1;

    $incorrect_user1->pass_raw .= 'incorrect';

    // Try 2 failed logins.

    for ($i = 0; $i < 2; $i++) {

      $this->assertFailedLogin($incorrect_user1);

    }

    // A successful login will not reset the IP-based flood control count.

    $this->drupalLogin($user1);

    $this->drupalLogout();

    // Try 8 more failed logins, they should not trigger the flood control

    // mechanism.

    for ($i = 0; $i < 8; $i++) {

      $this->assertFailedLogin($incorrect_user1);

    }

    // The next login trial should result in an IP-based flood error message.

    $this->assertFailedLogin($incorrect_user1, 'ip');

    // A login with the correct password should also result in a flood error

    // message.

    $this->assertFailedLogin($user1, 'ip');

  }

  /**

   * Test the per-user login flood control.

   */

  function testPerUserLoginFloodControl() {

    // Set a high global limit out so that it is not relevant in the test.

    variable_set('user_failed_login_ip_limit', 4000);

    // Set the per-user login limit.

    variable_set('user_failed_login_user_limit', 3);

    $user1 = $this->drupalCreateUser(array());

    $incorrect_user1 = clone $user1;

    $incorrect_user1->pass_raw .= 'incorrect';

    $user2 = $this->drupalCreateUser(array());

    // Try 2 failed logins.

    for ($i = 0; $i < 2; $i++) {

      $this->assertFailedLogin($incorrect_user1);

    }

    // A successful login will reset the per-user flood control count.

    $this->drupalLogin($user1);

    $this->drupalLogout();

    // Try 3 failed logins for user 1, they will not trigger flood control.

    for ($i = 0; $i < 3; $i++) {

      $this->assertFailedLogin($incorrect_user1);

    }

    // Try one successful attempt for user 2, it should not trigger any

    // flood control.

    $this->drupalLogin($user2);

    $this->drupalLogout();

    // Try one more attempt for user 1, it should be rejected, even if the

    // correct password has been used.

    $this->assertFailedLogin($user1, 'user');

  }

  /**

   * Test that user password is re-hashed upon login after changing $count_log2.

   */

  function testPasswordRehashOnLogin() {

    // Load password hashing API.

    require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'includes/password.inc');

    // Set initial $count_log2 to the default, DRUPAL_HASH_COUNT.

    variable_set('password_count_log2', DRUPAL_HASH_COUNT);

    // Create a new user and authenticate.

    $account = $this->drupalCreateUser(array());

    $password = $account->pass_raw;

    $this->drupalLogin($account);

    $this->drupalLogout();

    // Load the stored user. The password hash should reflect $count_log2.

    $account = user_load($account->uid);

    $this->assertIdentical(_password_get_count_log2($account->pass), DRUPAL_HASH_COUNT);

    // Change $count_log2 and log in again.

    variable_set('password_count_log2', DRUPAL_HASH_COUNT + 1);

    $account->pass_raw = $password;

    $this->drupalLogin($account);

    // Load the stored user, which should have a different password hash now.

    $account = user_load($account->uid, TRUE);

    $this->assertIdentical(_password_get_count_log2($account->pass), DRUPAL_HASH_COUNT + 1);

  }

  /**

   * Make an unsuccessful login attempt.

   *

   * @param $account

   *   A user object with name and pass_raw attributes for the login attempt.

   * @param $flood_trigger

   *   Whether or not to expect that the flood control mechanism will be

   *   triggered.

   */

  function assertFailedLogin($account, $flood_trigger = NULL) {

    $edit = array(

      'name' => $account->name,

      'pass' => $account->pass_raw,

    );

    $this->drupalPost('user', $edit, t('Log in'));

    $this->assertNoFieldByXPath("//input[@name='pass' and @value!='']", NULL, 'Password value attribute is blank.');

    if (isset($flood_trigger)) {

      if ($flood_trigger == 'user') {

        $this->assertRaw(format_plural(variable_get('user_failed_login_user_limit', 5), 'Sorry, there has been more than one failed login attempt for this account. It is temporarily blocked. Try again later or <a href="@url">request a new password</a>.', 'Sorry, there have been more than @count failed login attempts for this account. It is temporarily blocked. Try again later or <a href="@url">request a new password</a>.', array('@url' => url('user/password'))));

      }

      else {

        // No uid, so the limit is IP-based.

        $this->assertRaw(t('Sorry, too many failed login attempts from your IP address. This IP address is temporarily blocked. Try again later or <a href="@url">request a new password</a>.', array('@url' => url('user/password'))));

      }

    }

    else {

      $this->assertText(t('Sorry, unrecognized username or password. Have you forgotten your password?'));

    }

  }

}

/**

 * Tests resetting a user password.

 */

class UserPasswordResetTestCase extends DrupalWebTestCase {

  protected $profile = 'standard';

  public static function getInfo() {

    return array(

      'name' => 'Reset password',

      'description' => 'Ensure that password reset methods work as expected.',

      'group' => 'User',

    );

  }

  /**

   * Retrieves password reset email and extracts the login link.

   */

  public function getResetURL() {

    // Assume the most recent email.

    $_emails = $this->drupalGetMails();

    $email = end($_emails);

    $urls = array();

    preg_match('#.+user/reset/.+#', $email['body'], $urls);

    return $urls[0];

  }

  /**

   * Tests password reset functionality.

   */

  function testUserPasswordReset() {

    // Create a user.

    $account = $this->drupalCreateUser();

    $this->drupalLogin($account);

    $this->drupalLogout();

    // Attempt to reset password.

    $edit = array('name' => $account->name);

    $this->drupalPost('user/password', $edit, t('E-mail new password'));

    // Confirm the password reset.

    $this->assertText(t('Further instructions have been sent to your e-mail address.'), 'Password reset instructions mailed message displayed.');

    // Create an image field to enable an Ajax request on the user profile page.

    $field = array(

      'field_name' => 'field_avatar',

      'type' => 'image',

      'settings' => array(),

      'cardinality' => 1,

    );

    field_create_field($field);

    $instance = array(

      'field_name' => $field['field_name'],

      'entity_type' => 'user',

      'label' => 'Avatar',

      'bundle' => 'user',

      'required' => FALSE,

      'settings' => array(),

      'widget' => array(

        'type' => 'image_image',

        'settings' => array(),

      ),

    );

    field_create_instance($instance);

    $resetURL = $this->getResetURL();

    $this->drupalGet($resetURL);

    // Check successful login.

    $this->drupalPost(NULL, NULL, t('Log in'));

    // Make sure the Ajax request from uploading a file does not invalidate the

    // reset token.

    $image = current($this->drupalGetTestFiles('image'));

    $edit = array(

      'files[field_avatar_und_0]' => drupal_realpath($image->uri),

    );