1 <?php

     2 

     3 /**

     4  * @file

     5  * Tests for user.module.

     6  */

     7 

     8 class UserRegistrationTestCase extends DrupalWebTestCase {

     9   public static function getInfo() {

    10     return array(

    11       'name' => 'User registration',

    12       'description' => 'Test registration of user under different configurations.',

    13       'group' => 'User'

    14     );

    15   }

    16 

    17   function setUp() {

    18     parent::setUp('field_test');

    19   }

    20 

    21   function testRegistrationWithEmailVerification() {

    22     // Require e-mail verification.

    23     variable_set('user_email_verification', TRUE);

    24 

    25     // Set registration to administrator only.

    26     variable_set('user_register', USER_REGISTER_ADMINISTRATORS_ONLY);

    27     $this->drupalGet('user/register');

    28     $this->assertResponse(403, 'Registration page is inaccessible when only administrators can create accounts.');

    29 

    30     // Allow registration by site visitors without administrator approval.

    31     variable_set('user_register', USER_REGISTER_VISITORS);

    32     $edit = array();

    33     $edit['name'] = $name = $this->randomName();

    34     $edit['mail'] = $mail = $edit['name'] . '@example.com';

    35     $this->drupalPost('user/register', $edit, t('Create new account'));

    36     $this->assertText(t('A welcome message with further instructions has been sent to your e-mail address.'), 'User registered successfully.');

    37     $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

    38     $new_user = reset($accounts);

    39     $this->assertTrue($new_user->status, 'New account is active after registration.');

    40 

    41     // Allow registration by site visitors, but require administrator approval.

    42     variable_set('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL);

    43     $edit = array();

    44     $edit['name'] = $name = $this->randomName();

    45     $edit['mail'] = $mail = $edit['name'] . '@example.com';

    46     $this->drupalPost('user/register', $edit, t('Create new account'));

    47     $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

    48     $new_user = reset($accounts);

    49     $this->assertFalse($new_user->status, 'New account is blocked until approved by an administrator.');

    50   }

    51 

    52   function testRegistrationWithoutEmailVerification() {

    53     // Don't require e-mail verification.

    54     variable_set('user_email_verification', FALSE);

    55 

    56     // Allow registration by site visitors without administrator approval.

    57     variable_set('user_register', USER_REGISTER_VISITORS);

    58     $edit = array();

    59     $edit['name'] = $name = $this->randomName();

    60     $edit['mail'] = $mail = $edit['name'] . '@example.com';

    61 

    62     // Try entering a mismatching password.

    63     $edit['pass[pass1]'] = '99999.0';

    64     $edit['pass[pass2]'] = '99999';

    65     $this->drupalPost('user/register', $edit, t('Create new account'));

    66     $this->assertText(t('The specified passwords do not match.'), 'Typing mismatched passwords displays an error message.');

    67 

    68     // Enter a correct password.

    69     $edit['pass[pass1]'] = $new_pass = $this->randomName();

    70     $edit['pass[pass2]'] = $new_pass;

    71     $this->drupalPost('user/register', $edit, t('Create new account'));

    72     $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

    73     $new_user = reset($accounts);

    74     $this->assertText(t('Registration successful. You are now logged in.'), 'Users are logged in after registering.');

    75     $this->drupalLogout();

    76 

    77     // Allow registration by site visitors, but require administrator approval.

    78     variable_set('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL);

    79     $edit = array();

    80     $edit['name'] = $name = $this->randomName();

    81     $edit['mail'] = $mail = $edit['name'] . '@example.com';

    82     $edit['pass[pass1]'] = $pass = $this->randomName();

    83     $edit['pass[pass2]'] = $pass;

    84     $this->drupalPost('user/register', $edit, t('Create new account'));

    85     $this->assertText(t('Thank you for applying for an account. Your account is currently pending approval by the site administrator.'), 'Users are notified of pending approval');

    86 

    87     // Try to login before administrator approval.

    88     $auth = array(

    89       'name' => $name,

    90       'pass' => $pass,

    91     );

    92     $this->drupalPost('user/login', $auth, t('Log in'));

    93     $this->assertText(t('The username @name has not been activated or is blocked.', array('@name' => $name)), 'User cannot login yet.');

    94 

    95     // Activate the new account.

    96     $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

    97     $new_user = reset($accounts);

    98     $admin_user = $this->drupalCreateUser(array('administer users'));

    99     $this->drupalLogin($admin_user);

   100     $edit = array(

   101       'status' => 1,

   102     );

   103     $this->drupalPost('user/' . $new_user->uid . '/edit', $edit, t('Save'));

   104     $this->drupalLogout();

   105 

   106     // Login after administrator approval.

   107     $this->drupalPost('user/login', $auth, t('Log in'));

   108     $this->assertText(t('Member for'), 'User can log in after administrator approval.');

   109   }

   110 

   111   function testRegistrationEmailDuplicates() {

   112     // Don't require e-mail verification.

   113     variable_set('user_email_verification', FALSE);

   114 

   115     // Allow registration by site visitors without administrator approval.

   116     variable_set('user_register', USER_REGISTER_VISITORS);

   117 

   118     // Set up a user to check for duplicates.

   119     $duplicate_user = $this->drupalCreateUser();

   120 

   121     $edit = array();

   122     $edit['name'] = $this->randomName();

   123     $edit['mail'] = $duplicate_user->mail;

   124 

   125     // Attempt to create a new account using an existing e-mail address.

   126     $this->drupalPost('user/register', $edit, t('Create new account'));

   127     $this->assertText(t('The e-mail address @email is already registered.', array('@email' => $duplicate_user->mail)), 'Supplying an exact duplicate email address displays an error message');

   128 

   129     // Attempt to bypass duplicate email registration validation by adding spaces.

   130     $edit['mail'] = '   ' . $duplicate_user->mail . '   ';

   131 

   132     $this->drupalPost('user/register', $edit, t('Create new account'));

   133     $this->assertText(t('The e-mail address @email is already registered.', array('@email' => $duplicate_user->mail)), 'Supplying a duplicate email address with added whitespace displays an error message');

   134   }

   135 

   136   function testRegistrationDefaultValues() {

   137     // Allow registration by site visitors without administrator approval.

   138     variable_set('user_register', USER_REGISTER_VISITORS);

   139 

   140     // Don't require e-mail verification.

   141     variable_set('user_email_verification', FALSE);

   142 

   143     // Set the default timezone to Brussels.

   144     variable_set('configurable_timezones', 1);

   145     variable_set('date_default_timezone', 'Europe/Brussels');

   146 

   147     // Check that the account information fieldset's options are not displayed

   148     // is a fieldset if there is not more than one fieldset in the form.

   149     $this->drupalGet('user/register');

   150     $this->assertNoRaw('<fieldset id="edit-account"><legend>Account information</legend>', 'Account settings fieldset was hidden.');

   151 

   152     $edit = array();

   153     $edit['name'] = $name = $this->randomName();

   154     $edit['mail'] = $mail = $edit['name'] . '@example.com';

   155     $edit['pass[pass1]'] = $new_pass = $this->randomName();

   156     $edit['pass[pass2]'] = $new_pass;

   157     $this->drupalPost(NULL, $edit, t('Create new account'));

   158 

   159     // Check user fields.

   160     $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

   161     $new_user = reset($accounts);

   162     $this->assertEqual($new_user->name, $name, 'Username matches.');

   163     $this->assertEqual($new_user->mail, $mail, 'E-mail address matches.');

   164     $this->assertEqual($new_user->theme, '', 'Correct theme field.');

   165     $this->assertEqual($new_user->signature, '', 'Correct signature field.');

   166     $this->assertTrue(($new_user->created > REQUEST_TIME - 20 ), 'Correct creation time.');

   167     $this->assertEqual($new_user->status, variable_get('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL) == USER_REGISTER_VISITORS ? 1 : 0, 'Correct status field.');

   168     $this->assertEqual($new_user->timezone, variable_get('date_default_timezone'), 'Correct time zone field.');

   169     $this->assertEqual($new_user->language, '', 'Correct language field.');

   170     $this->assertEqual($new_user->picture, '', 'Correct picture field.');

   171     $this->assertEqual($new_user->init, $mail, 'Correct init field.');

   172   }

   173 

   174   /**

   175    * Tests Field API fields on user registration forms.

   176    */

   177   function testRegistrationWithUserFields() {

   178     // Create a field, and an instance on 'user' entity type.

   179     $field = array(

   180       'type' => 'test_field',

   181       'field_name' => 'test_user_field',

   182       'cardinality' => 1,

   183     );

   184     field_create_field($field);

   185     $instance = array(

   186       'field_name' => 'test_user_field',

   187       'entity_type' => 'user',

   188       'label' => 'Some user field',

   189       'bundle' => 'user',

   190       'required' => TRUE,

   191       'settings' => array('user_register_form' => FALSE),

   192     );

   193     field_create_instance($instance);

   194 

   195     // Check that the field does not appear on the registration form.

   196     $this->drupalGet('user/register');

   197     $this->assertNoText($instance['label'], 'The field does not appear on user registration form');

   198 

   199     // Have the field appear on the registration form.

   200     $instance['settings']['user_register_form'] = TRUE;

   201     field_update_instance($instance);

   202     $this->drupalGet('user/register');

   203     $this->assertText($instance['label'], 'The field appears on user registration form');

   204 

   205     // Check that validation errors are correctly reported.

   206     $edit = array();

   207     $edit['name'] = $name = $this->randomName();

   208     $edit['mail'] = $mail = $edit['name'] . '@example.com';

   209     // Missing input in required field.

   210     $edit['test_user_field[und][0][value]'] = '';

   211     $this->drupalPost(NULL, $edit, t('Create new account'));

   212     $this->assertRaw(t('@name field is required.', array('@name' => $instance['label'])), 'Field validation error was correctly reported.');

   213     // Invalid input.

   214     $edit['test_user_field[und][0][value]'] = '-1';

   215     $this->drupalPost(NULL, $edit, t('Create new account'));

   216     $this->assertRaw(t('%name does not accept the value -1.', array('%name' => $instance['label'])), 'Field validation error was correctly reported.');

   217 

   218     // Submit with valid data.

   219     $value = rand(1, 255);

   220     $edit['test_user_field[und][0][value]'] = $value;

   221     $this->drupalPost(NULL, $edit, t('Create new account'));

   222     // Check user fields.

   223     $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

   224     $new_user = reset($accounts);

   225     $this->assertEqual($new_user->test_user_field[LANGUAGE_NONE][0]['value'], $value, 'The field value was correctly saved.');

   226 

   227     // Check that the 'add more' button works.

   228     $field['cardinality'] = FIELD_CARDINALITY_UNLIMITED;

   229     field_update_field($field);

   230     foreach (array('js', 'nojs') as $js) {

   231       $this->drupalGet('user/register');

   232       // Add two inputs.

   233       $value = rand(1, 255);

   234       $edit = array();

   235       $edit['test_user_field[und][0][value]'] = $value;

   236       if ($js == 'js') {

   237         $this->drupalPostAJAX(NULL, $edit, 'test_user_field_add_more');

   238         $this->drupalPostAJAX(NULL, $edit, 'test_user_field_add_more');

   239       }

   240       else {

   241         $this->drupalPost(NULL, $edit, t('Add another item'));

   242         $this->drupalPost(NULL, $edit, t('Add another item'));

   243       }

   244       // Submit with three values.

   245       $edit['test_user_field[und][1][value]'] = $value + 1;

   246       $edit['test_user_field[und][2][value]'] = $value + 2;

   247       $edit['name'] = $name = $this->randomName();

   248       $edit['mail'] = $mail = $edit['name'] . '@example.com';

   249       $this->drupalPost(NULL, $edit, t('Create new account'));

   250       // Check user fields.

   251       $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

   252       $new_user = reset($accounts);

   253       $this->assertEqual($new_user->test_user_field[LANGUAGE_NONE][0]['value'], $value, format_string('@js : The field value was correclty saved.', array('@js' => $js)));

   254       $this->assertEqual($new_user->test_user_field[LANGUAGE_NONE][1]['value'], $value + 1, format_string('@js : The field value was correclty saved.', array('@js' => $js)));

   255       $this->assertEqual($new_user->test_user_field[LANGUAGE_NONE][2]['value'], $value + 2, format_string('@js : The field value was correclty saved.', array('@js' => $js)));

   256     }

   257   }

   258 }

   259 

   260 class UserValidationTestCase extends DrupalWebTestCase {

   261   public static function getInfo() {

   262     return array(

   263       'name' => 'Username/e-mail validation',

   264       'description' => 'Verify that username/email validity checks behave as designed.',

   265       'group' => 'User'

   266     );

   267   }

   268 

   269   // Username validation.

   270   function testUsernames() {

   271     $test_cases = array( // '<username>' => array('<description>', 'assert<testName>'),

   272       'foo'                    => array('Valid username', 'assertNull'),

   273       'FOO'                    => array('Valid username', 'assertNull'),

   274       'Foo O\'Bar'             => array('Valid username', 'assertNull'),

   275       'foo@bar'                => array('Valid username', 'assertNull'),

   276       'foo@example.com'        => array('Valid username', 'assertNull'),

   277       'foo@-example.com'       => array('Valid username', 'assertNull'), // invalid domains are allowed in usernames

   278       'þòøÇߪř€'               => array('Valid username', 'assertNull'),

   279       'ᚠᛇᚻ᛫ᛒᛦᚦ'                => array('Valid UTF8 username', 'assertNull'), // runes

   280       ' foo'                   => array('Invalid username that starts with a space', 'assertNotNull'),

   281       'foo '                   => array('Invalid username that ends with a space', 'assertNotNull'),

   282       'foo  bar'               => array('Invalid username that contains 2 spaces \'  \'', 'assertNotNull'),

   283       ''                       => array('Invalid empty username', 'assertNotNull'),

   284       'foo/'                   => array('Invalid username containing invalid chars', 'assertNotNull'),

   285       'foo' . chr(0) . 'bar'   => array('Invalid username containing chr(0)', 'assertNotNull'), // NULL

   286       'foo' . chr(13) . 'bar'  => array('Invalid username containing chr(13)', 'assertNotNull'), // CR

   287       str_repeat('x', USERNAME_MAX_LENGTH + 1) => array('Invalid excessively long username', 'assertNotNull'),

   288     );

   289     foreach ($test_cases as $name => $test_case) {

   290       list($description, $test) = $test_case;

   291       $result = user_validate_name($name);

   292       $this->$test($result, $description . ' (' . $name . ')');

   293     }

   294   }

   295 

   296   // Mail validation. More extensive tests can be found at common.test

   297   function testMailAddresses() {

   298     $test_cases = array( // '<username>' => array('<description>', 'assert<testName>'),

   299       ''                => array('Empty mail address', 'assertNotNull'),

   300       'foo'             => array('Invalid mail address', 'assertNotNull'),

   301       'foo@example.com' => array('Valid mail address', 'assertNull'),

   302     );

   303     foreach ($test_cases as $name => $test_case) {

   304       list($description, $test) = $test_case;

   305       $result = user_validate_mail($name);

   306       $this->$test($result, $description . ' (' . $name . ')');

   307     }

   308   }

   309 }

   310 

   311 /**

   312  * Functional tests for user logins, including rate limiting of login attempts.

   313  */

   314 class UserLoginTestCase extends DrupalWebTestCase {

   315   public static function getInfo() {

   316     return array(

   317       'name' => 'User login',

   318       'description' => 'Ensure that login works as expected.',

   319       'group' => 'User',

   320     );

   321   }

   322 

   323   /**

   324    * Test the global login flood control.

   325    */

   326   function testGlobalLoginFloodControl() {

   327     // Set the global login limit.

   328     variable_set('user_failed_login_ip_limit', 10);

   329     // Set a high per-user limit out so that it is not relevant in the test.

   330     variable_set('user_failed_login_user_limit', 4000);

   331 

   332     $user1 = $this->drupalCreateUser(array());

   333     $incorrect_user1 = clone $user1;

   334     $incorrect_user1->pass_raw .= 'incorrect';

   335 

   336     // Try 2 failed logins.

   337     for ($i = 0; $i < 2; $i++) {

   338       $this->assertFailedLogin($incorrect_user1);

   339     }

   340 

   341     // A successful login will not reset the IP-based flood control count.

   342     $this->drupalLogin($user1);

   343     $this->drupalLogout();

   344 

   345     // Try 8 more failed logins, they should not trigger the flood control

   346     // mechanism.

   347     for ($i = 0; $i < 8; $i++) {

   348       $this->assertFailedLogin($incorrect_user1);

   349     }

   350 

   351     // The next login trial should result in an IP-based flood error message.

   352     $this->assertFailedLogin($incorrect_user1, 'ip');

   353 

   354     // A login with the correct password should also result in a flood error

   355     // message.

   356     $this->assertFailedLogin($user1, 'ip');

   357   }

   358 

   359   /**

   360    * Test the per-user login flood control.

   361    */

   362   function testPerUserLoginFloodControl() {

   363     // Set a high global limit out so that it is not relevant in the test.

   364     variable_set('user_failed_login_ip_limit', 4000);

   365     // Set the per-user login limit.

   366     variable_set('user_failed_login_user_limit', 3);

   367 

   368     $user1 = $this->drupalCreateUser(array());

   369     $incorrect_user1 = clone $user1;

   370     $incorrect_user1->pass_raw .= 'incorrect';

   371 

   372     $user2 = $this->drupalCreateUser(array());

   373 

   374     // Try 2 failed logins.

   375     for ($i = 0; $i < 2; $i++) {

   376       $this->assertFailedLogin($incorrect_user1);

   377     }

   378 

   379     // A successful login will reset the per-user flood control count.

   380     $this->drupalLogin($user1);

   381     $this->drupalLogout();

   382 

   383     // Try 3 failed logins for user 1, they will not trigger flood control.

   384     for ($i = 0; $i < 3; $i++) {

   385       $this->assertFailedLogin($incorrect_user1);

   386     }

   387 

   388     // Try one successful attempt for user 2, it should not trigger any

   389     // flood control.

   390     $this->drupalLogin($user2);

   391     $this->drupalLogout();

   392 

   393     // Try one more attempt for user 1, it should be rejected, even if the

   394     // correct password has been used.

   395     $this->assertFailedLogin($user1, 'user');

   396   }

   397 

   398   /**

   399    * Test that user password is re-hashed upon login after changing $count_log2.

   400    */

   401   function testPasswordRehashOnLogin() {

   402     // Load password hashing API.

   403     require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'includes/password.inc');

   404     // Set initial $count_log2 to the default, DRUPAL_HASH_COUNT.

   405     variable_set('password_count_log2', DRUPAL_HASH_COUNT);

   406     // Create a new user and authenticate.

   407     $account = $this->drupalCreateUser(array());

   408     $password = $account->pass_raw;

   409     $this->drupalLogin($account);

   410     $this->drupalLogout();

   411     // Load the stored user. The password hash should reflect $count_log2.

   412     $account = user_load($account->uid);

   413     $this->assertIdentical(_password_get_count_log2($account->pass), DRUPAL_HASH_COUNT);

   414     // Change $count_log2 and log in again.

   415     variable_set('password_count_log2', DRUPAL_HASH_COUNT + 1);

   416     $account->pass_raw = $password;

   417     $this->drupalLogin($account);

   418     // Load the stored user, which should have a different password hash now.

   419     $account = user_load($account->uid, TRUE);

   420     $this->assertIdentical(_password_get_count_log2($account->pass), DRUPAL_HASH_COUNT + 1);

   421   }

   422 

   423   /**

   424    * Make an unsuccessful login attempt.

   425    *

   426    * @param $account

   427    *   A user object with name and pass_raw attributes for the login attempt.

   428    * @param $flood_trigger

   429    *   Whether or not to expect that the flood control mechanism will be

   430    *   triggered.

   431    */

   432   function assertFailedLogin($account, $flood_trigger = NULL) {

   433     $edit = array(

   434       'name' => $account->name,

   435       'pass' => $account->pass_raw,

   436     );

   437     $this->drupalPost('user', $edit, t('Log in'));

   438     $this->assertNoFieldByXPath("//input[@name='pass' and @value!='']", NULL, 'Password value attribute is blank.');

   439     if (isset($flood_trigger)) {

   440       if ($flood_trigger == 'user') {

   441         $this->assertRaw(format_plural(variable_get('user_failed_login_user_limit', 5), 'Sorry, there has been more than one failed login attempt for this account. It is temporarily blocked. Try again later or <a href="@url">request a new password</a>.', 'Sorry, there have been more than @count failed login attempts for this account. It is temporarily blocked. Try again later or <a href="@url">request a new password</a>.', array('@url' => url('user/password'))));

   442       }

   443       else {

   444         // No uid, so the limit is IP-based.

   445         $this->assertRaw(t('Sorry, too many failed login attempts from your IP address. This IP address is temporarily blocked. Try again later or <a href="@url">request a new password</a>.', array('@url' => url('user/password'))));

   446       }

   447     }

   448     else {

   449       $this->assertText(t('Sorry, unrecognized username or password. Have you forgotten your password?'));

   450     }

   451   }

   452 }

   453 

   454 /**

   455  * Tests resetting a user password.

   456  */

   457 class UserPasswordResetTestCase extends DrupalWebTestCase {

   458   protected $profile = 'standard';

   459 

   460   public static function getInfo() {

   461     return array(

   462       'name' => 'Reset password',

   463       'description' => 'Ensure that password reset methods work as expected.',

   464       'group' => 'User',

   465     );

   466   }

   467 

   468   /**

   469    * Retrieves password reset email and extracts the login link.

   470    */

   471   public function getResetURL() {

   472     // Assume the most recent email.

   473     $_emails = $this->drupalGetMails();

   474     $email = end($_emails);

   475     $urls = array();

   476     preg_match('#.+user/reset/.+#', $email['body'], $urls);

   477 

   478     return $urls[0];

   479   }

   480 

   481   /**

   482    * Tests password reset functionality.

   483    */

   484   function testUserPasswordReset() {

   485     // Create a user.

   486     $account = $this->drupalCreateUser();

   487     $this->drupalLogin($account);

   488     $this->drupalLogout();

   489     // Attempt to reset password.

   490     $edit = array('name' => $account->name);

   491     $this->drupalPost('user/password', $edit, t('E-mail new password'));

   492     // Confirm the password reset.

   493     $this->assertText(t('Further instructions have been sent to your e-mail address.'), 'Password reset instructions mailed message displayed.');

   494 

   495     // Create an image field to enable an Ajax request on the user profile page.

   496     $field = array(

   497       'field_name' => 'field_avatar',

   498       'type' => 'image',

   499       'settings' => array(),

   500       'cardinality' => 1,

   501     );

   502     field_create_field($field);

   503 

   504     $instance = array(

   505       'field_name' => $field['field_name'],

   506       'entity_type' => 'user',

   507       'label' => 'Avatar',

   508       'bundle' => 'user',

   509       'required' => FALSE,

   510       'settings' => array(),

   511       'widget' => array(

   512         'type' => 'image_image',

   513         'settings' => array(),

   514       ),

   515     );

   516     field_create_instance($instance);

   517 

   518     $resetURL = $this->getResetURL();

   519     $this->drupalGet($resetURL);

   520 

   521     // Check successful login.

   522     $this->drupalPost(NULL, NULL, t('Log in'));

   523 

   524     // Make sure the Ajax request from uploading a file does not invalidate the

   525     // reset token.

   526     $image = current($this->drupalGetTestFiles('image'));

   527     $edit = array(

   528       'files[field_avatar_und_0]' => drupal_realpath($image->uri),

   529     );

   530     $this->drupalPostAJAX(NULL, $edit, 'field_avatar_und_0_upload_button');

   531 

   532     // Change the forgotten password.

   533     $password = user_password();

   534     $edit = array('pass[pass1]' => $password, 'pass[pass2]' => $password);

   535     $this->drupalPost(NULL, $edit, t('Save'));

   536     $this->assertText(t('The changes have been saved.'), 'Forgotten password changed.');

   537   }

   538 

   539   /**

   540    * Test user password reset while logged in.

   541    */

   542   function testUserPasswordResetLoggedIn() {

   543     $account = $this->drupalCreateUser();

   544     $this->drupalLogin($account);

   545     // Make sure the test account has a valid password.

   546     user_save($account, array('pass' => user_password()));

   547 

   548     // Generate one time login link.

   549     $reset_url = user_pass_reset_url($account);

   550     $this->drupalGet($reset_url);

   551 

   552     $this->assertText('Reset password');

   553     $this->drupalPost(NULL, NULL, t('Log in'));

   554 

   555     $this->assertText('You have just used your one-time login link. It is no longer necessary to use this link to log in. Please change your password.');

   556 

   557     $pass = user_password();

   558     $edit = array(

   559       'pass[pass1]' => $pass,

   560       'pass[pass2]' => $pass,

   561     );

   562     $this->drupalPost(NULL, $edit, t('Save'));

   563 

   564     $this->assertText('The changes have been saved.');

   565   }

   566 

   567   /**

   568    * Attempts login using an expired password reset link.

   569    */

   570   function testUserPasswordResetExpired() {

   571     // Set password reset timeout variable to 43200 seconds = 12 hours.

   572     $timeout = 43200;

   573     variable_set('user_password_reset_timeout', $timeout);

   574 

   575     // Create a user.

   576     $account = $this->drupalCreateUser();

   577     $this->drupalLogin($account);

   578     // Load real user object.

   579     $account = user_load($account->uid, TRUE);

   580     $this->drupalLogout();

   581 

   582     // To attempt an expired password reset, create a password reset link as if

   583     // its request time was 60 seconds older than the allowed limit of timeout.

   584     $bogus_timestamp = REQUEST_TIME - variable_get('user_password_reset_timeout', 86400) - 60;

   585     $this->drupalGet("user/reset/$account->uid/$bogus_timestamp/" . user_pass_rehash($account->pass, $bogus_timestamp, $account->login, $account->uid));

   586     $this->assertText(t('You have tried to use a one-time login link that has expired. Please request a new one using the form below.'), 'Expired password reset request rejected.');

   587   }

   588 

   589   /**

   590    * Prefill the text box on incorrect login via link to password reset page.

   591    */

   592   function testUserPasswordTextboxFilled() {

   593     $this->drupalGet('user/login');

   594     $edit = array(

   595       'name' => $this->randomName(),

   596       'pass' => $this->randomName(),

   597     );

   598     $this->drupalPost('user', $edit, t('Log in'));

   599     $this->assertRaw(t('Sorry, unrecognized username or password. <a href="@password">Have you forgotten your password?</a>',

   600       array('@password' => url('user/password', array('query' => array('name' => $edit['name']))))));

   601     unset($edit['pass']);

   602     $this->drupalGet('user/password', array('query' => array('name' => $edit['name'])));

   603     $this->assertFieldByName('name', $edit['name'], 'User name found.');

   604   }

   605 

   606   /**

   607    * Make sure that users cannot forge password reset URLs of other users.

   608    */

   609   function testResetImpersonation() {

   610     // Make sure user 1 has a valid password, so it does not interfere with the

   611     // test user accounts that are created below.

   612     $account = user_load(1);

   613     user_save($account, array('pass' => user_password()));

   614 

   615     // Create two identical user accounts except for the user name. They must

   616     // have the same empty password, so we can't use $this->drupalCreateUser().

   617     $edit = array();

   618     $edit['name'] = $this->randomName();

   619     $edit['mail'] = $edit['name'] . '@example.com';

   620     $edit['status'] = 1;

   621 

   622     $user1 = user_save(drupal_anonymous_user(), $edit);

   623 

   624     $edit['name'] = $this->randomName();

   625     $user2 = user_save(drupal_anonymous_user(), $edit);

   626 

   627     // The password reset URL must not be valid for the second user when only

   628     // the user ID is changed in the URL.

   629     $reset_url = user_pass_reset_url($user1);

   630     $attack_reset_url = str_replace("user/reset/$user1->uid", "user/reset/$user2->uid", $reset_url);

   631     $this->drupalGet($attack_reset_url);

   632     $this->assertNoText($user2->name, 'The invalid password reset page does not show the user name.');

   633     $this->assertUrl('user/password', array(), 'The user is redirected to the password reset request page.');

   634     $this->assertText('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.');

   635 

   636     // When legacy code calls user_pass_rehash() without providing the $uid

   637     // parameter, neither password reset URL should be valid since it is

   638     // impossible for the system to determine which user account the token was

   639     // intended for.

   640     $timestamp = REQUEST_TIME;

   641     // Pass an explicit NULL for the $uid parameter of user_pass_rehash()

   642     // rather than not passing it at all, to avoid triggering PHP warnings in

   643     // the test.

   644     $reset_url_token = user_pass_rehash($user1->pass, $timestamp, $user1->login, NULL);

   645     $reset_url = url("user/reset/$user1->uid/$timestamp/$reset_url_token", array('absolute' => TRUE));

   646     $this->drupalGet($reset_url);

   647     $this->assertNoText($user1->name, 'The invalid password reset page does not show the user name.');

   648     $this->assertUrl('user/password', array(), 'The user is redirected to the password reset request page.');

   649     $this->assertText('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.');

   650     $attack_reset_url = str_replace("user/reset/$user1->uid", "user/reset/$user2->uid", $reset_url);

   651     $this->drupalGet($attack_reset_url);

   652     $this->assertNoText($user2->name, 'The invalid password reset page does not show the user name.');

   653     $this->assertUrl('user/password', array(), 'The user is redirected to the password reset request page.');

   654     $this->assertText('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.');

   655 

   656     // To verify that user_pass_rehash() never returns a valid result in the

   657     // above situation (even if legacy code also called it to attempt to

   658     // validate the token, rather than just to generate the URL), check that a

   659     // second call with the same parameters produces a different result.

   660     $new_reset_url_token = user_pass_rehash($user1->pass, $timestamp, $user1->login, NULL);

   661     $this->assertNotEqual($reset_url_token, $new_reset_url_token);

   662 

   663     // However, when the duplicate account is removed, the password reset URL

   664     // should be valid.

   665     user_delete($user2->uid);

   666     $reset_url_token = user_pass_rehash($user1->pass, $timestamp, $user1->login, NULL);

   667     $reset_url = url("user/reset/$user1->uid/$timestamp/$reset_url_token", array('absolute' => TRUE));

   668     $this->drupalGet($reset_url);

   669     $this->assertText($user1->name, 'The valid password reset page shows the user name.');

   670     $this->assertUrl($reset_url, array(), 'The user remains on the password reset login page.');

   671     $this->assertNoText('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.');

   672   }

   673 

   674 }

   675 

   676 /**

   677  * Test cancelling a user.

   678  */

   679 class UserCancelTestCase extends DrupalWebTestCase {

   680   public static function getInfo() {

   681     return array(

   682       'name' => 'Cancel account',

   683       'description' => 'Ensure that account cancellation methods work as expected.',

   684       'group' => 'User',

   685     );

   686   }

   687 

   688   function setUp() {

   689     parent::setUp('comment');

   690   }

   691 

   692   /**

   693    * Attempt to cancel account without permission.

   694    */

   695   function testUserCancelWithoutPermission() {

   696     variable_set('user_cancel_method', 'user_cancel_reassign');

   697 

   698     // Create a user.

   699     $account = $this->drupalCreateUser(array());

   700     $this->drupalLogin($account);

   701     // Load real user object.

   702     $account = user_load($account->uid, TRUE);

   703 

   704     // Create a node.

   705     $node = $this->drupalCreateNode(array('uid' => $account->uid));

   706 

   707     // Attempt to cancel account.

   708     $this->drupalGet('user/' . $account->uid . '/edit');

   709     $this->assertNoRaw(t('Cancel account'), 'No cancel account button displayed.');

   710 

   711     // Attempt bogus account cancellation request confirmation.

   712     $timestamp = $account->login;

   713     $this->drupalGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid));

   714     $this->assertResponse(403, 'Bogus cancelling request rejected.');

   715     $account = user_load($account->uid);

   716     $this->assertTrue($account->status == 1, 'User account was not canceled.');

   717 

   718     // Confirm user's content has not been altered.

   719     $test_node = node_load($node->nid, NULL, TRUE);

   720     $this->assertTrue(($test_node->uid == $account->uid && $test_node->status == 1), 'Node of the user has not been altered.');

   721   }

   722 

   723   /**

   724    * Tests that user account for uid 1 cannot be cancelled.

   725    *

   726    * This should never be possible, or the site owner would become unable to

   727    * administer the site.

   728    */

   729   function testUserCancelUid1() {

   730     // Update uid 1's name and password to we know it.

   731     $password = user_password();

   732     require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'includes/password.inc');

   733     $account = array(

   734       'name' => 'user1',

   735       'pass' => user_hash_password(trim($password)),

   736     );

   737     // We cannot use user_save() here or the password would be hashed again.

   738     db_update('users')

   739       ->fields($account)

   740       ->condition('uid', 1)

   741       ->execute();

   742 

   743     // Reload and log in uid 1.

   744     $user1 = user_load(1, TRUE);

   745     $user1->pass_raw = $password;

   746 

   747     // Try to cancel uid 1's account with a different user.

   748     $this->admin_user = $this->drupalCreateUser(array('administer users'));

   749     $this->drupalLogin($this->admin_user);

   750     $edit = array(

   751       'operation' => 'cancel',

   752       'accounts[1]' => TRUE,

   753     );

   754     $this->drupalPost('admin/people', $edit, t('Update'));

   755 

   756     // Verify that uid 1's account was not cancelled.

   757     $user1 = user_load(1, TRUE);

   758     $this->assertEqual($user1->status, 1, 'User #1 still exists and is not blocked.');

   759   }

   760 

   761   /**

   762    * Attempt invalid account cancellations.

   763    */

   764   function testUserCancelInvalid() {

   765     variable_set('user_cancel_method', 'user_cancel_reassign');

   766 

   767     // Create a user.

   768     $account = $this->drupalCreateUser(array('cancel account'));

   769     $this->drupalLogin($account);

   770     // Load real user object.

   771     $account = user_load($account->uid, TRUE);

   772 

   773     // Create a node.

   774     $node = $this->drupalCreateNode(array('uid' => $account->uid));

   775 

   776     // Attempt to cancel account.

   777     $this->drupalPost('user/' . $account->uid . '/edit', NULL, t('Cancel account'));

   778 

   779     // Confirm account cancellation.

   780     $timestamp = time();

   781     $this->drupalPost(NULL, NULL, t('Cancel account'));

   782     $this->assertText(t('A confirmation request to cancel your account has been sent to your e-mail address.'), 'Account cancellation request mailed message displayed.');

   783 

   784     // Attempt bogus account cancellation request confirmation.

   785     $bogus_timestamp = $timestamp + 60;

   786     $this->drupalGet("user/$account->uid/cancel/confirm/$bogus_timestamp/" . user_pass_rehash($account->pass, $bogus_timestamp, $account->login, $account->uid));

   787     $this->assertText(t('You have tried to use an account cancellation link that has expired. Please request a new one using the form below.'), 'Bogus cancelling request rejected.');

   788     $account = user_load($account->uid);

   789     $this->assertTrue($account->status == 1, 'User account was not canceled.');

   790 

   791     // Attempt expired account cancellation request confirmation.

   792     $bogus_timestamp = $timestamp - 86400 - 60;

   793     $this->drupalGet("user/$account->uid/cancel/confirm/$bogus_timestamp/" . user_pass_rehash($account->pass, $bogus_timestamp, $account->login, $account->uid));

   794     $this->assertText(t('You have tried to use an account cancellation link that has expired. Please request a new one using the form below.'), 'Expired cancel account request rejected.');

   795     $accounts = user_load_multiple(array($account->uid), array('status' => 1));

   796     $this->assertTrue(reset($accounts), 'User account was not canceled.');

   797 

   798     // Confirm user's content has not been altered.

   799     $test_node = node_load($node->nid, NULL, TRUE);

   800     $this->assertTrue(($test_node->uid == $account->uid && $test_node->status == 1), 'Node of the user has not been altered.');

   801   }

   802 

   803   /**

   804    * Disable account and keep all content.

   805    */

   806   function testUserBlock() {

   807     variable_set('user_cancel_method', 'user_cancel_block');

   808 

   809     // Create a user.

   810     $web_user = $this->drupalCreateUser(array('cancel account'));

   811     $this->drupalLogin($web_user);

   812 

   813     // Load real user object.

   814     $account = user_load($web_user->uid, TRUE);

   815 

   816     // Attempt to cancel account.

   817     $this->drupalGet('user/' . $account->uid . '/edit');

   818     $this->drupalPost(NULL, NULL, t('Cancel account'));

   819     $this->assertText(t('Are you sure you want to cancel your account?'), 'Confirmation form to cancel account displayed.');

   820     $this->assertText(t('Your account will be blocked and you will no longer be able to log in. All of your content will remain attributed to your user name.'), 'Informs that all content will be remain as is.');

   821     $this->assertNoText(t('Select the method to cancel the account above.'), 'Does not allow user to select account cancellation method.');

   822 

   823     // Confirm account cancellation.

   824     $timestamp = time();

   825 

   826     $this->drupalPost(NULL, NULL, t('Cancel account'));

   827     $this->assertText(t('A confirmation request to cancel your account has been sent to your e-mail address.'), 'Account cancellation request mailed message displayed.');

   828 

   829     // Confirm account cancellation request.

   830     $this->drupalGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid));

   831     $account = user_load($account->uid, TRUE);

   832     $this->assertTrue($account->status == 0, 'User has been blocked.');

   833 

   834     // Confirm that the confirmation message made it through to the end user.

   835     $this->assertRaw(t('%name has been disabled.', array('%name' => $account->name)), "Confirmation message displayed to user.");

   836   }

   837 

   838   /**

   839    * Disable account and unpublish all content.

   840    */

   841   function testUserBlockUnpublish() {

   842     variable_set('user_cancel_method', 'user_cancel_block_unpublish');

   843 

   844     // Create a user.

   845     $account = $this->drupalCreateUser(array('cancel account'));

   846     $this->drupalLogin($account);

   847     // Load real user object.

   848     $account = user_load($account->uid, TRUE);

   849 

   850     // Create a node with two revisions.

   851     $node = $this->drupalCreateNode(array('uid' => $account->uid));

   852     $settings = get_object_vars($node);

   853     $settings['revision'] = 1;

   854     $node = $this->drupalCreateNode($settings);

   855 

   856     // Attempt to cancel account.

   857     $this->drupalGet('user/' . $account->uid . '/edit');

   858     $this->drupalPost(NULL, NULL, t('Cancel account'));

   859     $this->assertText(t('Are you sure you want to cancel your account?'), 'Confirmation form to cancel account displayed.');

   860     $this->assertText(t('Your account will be blocked and you will no longer be able to log in. All of your content will be hidden from everyone but administrators.'), 'Informs that all content will be unpublished.');

   861 

   862     // Confirm account cancellation.

   863     $timestamp = time();

   864     $this->drupalPost(NULL, NULL, t('Cancel account'));

   865     $this->assertText(t('A confirmation request to cancel your account has been sent to your e-mail address.'), 'Account cancellation request mailed message displayed.');

   866 

   867     // Confirm account cancellation request.

   868     $this->drupalGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid));

   869     $account = user_load($account->uid, TRUE);

   870     $this->assertTrue($account->status == 0, 'User has been blocked.');

   871 

   872     // Confirm user's content has been unpublished.

   873     $test_node = node_load($node->nid, NULL, TRUE);

   874     $this->assertTrue($test_node->status == 0, 'Node of the user has been unpublished.');

   875     $test_node = node_load($node->nid, $node->vid, TRUE);

   876     $this->assertTrue($test_node->status == 0, 'Node revision of the user has been unpublished.');

   877 

   878     // Confirm that the confirmation message made it through to the end user.

   879     $this->assertRaw(t('%name has been disabled.', array('%name' => $account->name)), "Confirmation message displayed to user.");

   880   }

   881 

   882   /**

   883    * Delete account and anonymize all content.

   884    */

   885   function testUserAnonymize() {

   886     variable_set('user_cancel_method', 'user_cancel_reassign');

   887 

   888     // Create a user.

   889     $account = $this->drupalCreateUser(array('cancel account'));

   890     $this->drupalLogin($account);

   891     // Load real user object.

   892     $account = user_load($account->uid, TRUE);

   893 

   894     // Create a simple node.

   895     $node = $this->drupalCreateNode(array('uid' => $account->uid));

   896 

   897     // Create a node with two revisions, the initial one belonging to the

   898     // cancelling user.

   899     $revision_node = $this->drupalCreateNode(array('uid' => $account->uid));

   900     $revision = $revision_node->vid;

   901     $settings = get_object_vars($revision_node);

   902     $settings['revision'] = 1;

   903     $settings['uid'] = 1; // Set new/current revision to someone else.

   904     $revision_node = $this->drupalCreateNode($settings);

   905 

   906     // Attempt to cancel account.

   907     $this->drupalGet('user/' . $account->uid . '/edit');

   908     $this->drupalPost(NULL, NULL, t('Cancel account'));

   909     $this->assertText(t('Are you sure you want to cancel your account?'), 'Confirmation form to cancel account displayed.');

   910     $this->assertRaw(t('Your account will be removed and all account information deleted. All of your content will be assigned to the %anonymous-name user.', array('%anonymous-name' => variable_get('anonymous', t('Anonymous')))), 'Informs that all content will be attributed to anonymous account.');

   911 

   912     // Confirm account cancellation.

   913     $timestamp = time();

   914     $this->drupalPost(NULL, NULL, t('Cancel account'));

   915     $this->assertText(t('A confirmation request to cancel your account has been sent to your e-mail address.'), 'Account cancellation request mailed message displayed.');

   916 

   917     // Confirm account cancellation request.

   918     $this->drupalGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid));

   919     $this->assertFalse(user_load($account->uid, TRUE), 'User is not found in the database.');

   920 

   921     // Confirm that user's content has been attributed to anonymous user.

   922     $test_node = node_load($node->nid, NULL, TRUE);

   923     $this->assertTrue(($test_node->uid == 0 && $test_node->status == 1), 'Node of the user has been attributed to anonymous user.');

   924     $test_node = node_load($revision_node->nid, $revision, TRUE);

   925     $this->assertTrue(($test_node->revision_uid == 0 && $test_node->status == 1), 'Node revision of the user has been attributed to anonymous user.');

   926     $test_node = node_load($revision_node->nid, NULL, TRUE);

   927     $this->assertTrue(($test_node->uid != 0 && $test_node->status == 1), "Current revision of the user's node was not attributed to anonymous user.");

   928 

   929     // Confirm that the confirmation message made it through to the end user.

   930     $this->assertRaw(t('%name has been deleted.', array('%name' => $account->name)), "Confirmation message displayed to user.");

   931   }

   932 

   933   /**

   934    * Delete account and remove all content.

   935    */

   936   function testUserDelete() {

   937     variable_set('user_cancel_method', 'user_cancel_delete');

   938 

   939     // Create a user.

   940     $account = $this->drupalCreateUser(array('cancel account', 'post comments', 'skip comment approval'));

   941     $this->drupalLogin($account);

   942     // Load real user object.

   943     $account = user_load($account->uid, TRUE);

   944 

   945     // Create a simple node.

   946     $node = $this->drupalCreateNode(array('uid' => $account->uid));

   947 

   948     // Create comment.

   949     $langcode = LANGUAGE_NONE;

   950     $edit = array();

   951     $edit['subject'] = $this->randomName(8);

   952     $edit['comment_body[' . $langcode . '][0][value]'] = $this->randomName(16);

   953 

   954     $this->drupalPost('comment/reply/' . $node->nid, $edit, t('Preview'));

   955     $this->drupalPost(NULL, array(), t('Save'));

   956     $this->assertText(t('Your comment has been posted.'));

   957     $comments = comment_load_multiple(array(), array('subject' => $edit['subject']));

   958     $comment = reset($comments);

   959     $this->assertTrue($comment->cid, 'Comment found.');

   960 

   961     // Create a node with two revisions, the initial one belonging to the

   962     // cancelling user.

   963     $revision_node = $this->drupalCreateNode(array('uid' => $account->uid));

   964     $revision = $revision_node->vid;

   965     $settings = get_object_vars($revision_node);

   966     $settings['revision'] = 1;

   967     $settings['uid'] = 1; // Set new/current revision to someone else.

   968     $revision_node = $this->drupalCreateNode($settings);

   969 

   970     // Attempt to cancel account.

   971     $this->drupalGet('user/' . $account->uid . '/edit');

   972     $this->drupalPost(NULL, NULL, t('Cancel account'));

   973     $this->assertText(t('Are you sure you want to cancel your account?'), 'Confirmation form to cancel account displayed.');

   974     $this->assertText(t('Your account will be removed and all account information deleted. All of your content will also be deleted.'), 'Informs that all content will be deleted.');

   975 

   976     // Confirm account cancellation.

   977     $timestamp = time();

   978     $this->drupalPost(NULL, NULL, t('Cancel account'));

   979     $this->assertText(t('A confirmation request to cancel your account has been sent to your e-mail address.'), 'Account cancellation request mailed message displayed.');

   980 

   981     // Confirm account cancellation request.

   982     $this->drupalGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid));

   983     $this->assertFalse(user_load($account->uid, TRUE), 'User is not found in the database.');

   984 

   985     // Confirm that user's content has been deleted.

   986     $this->assertFalse(node_load($node->nid, NULL, TRUE), 'Node of the user has been deleted.');

   987     $this->assertFalse(node_load($node->nid, $revision, TRUE), 'Node revision of the user has been deleted.');

   988     $this->assertTrue(node_load($revision_node->nid, NULL, TRUE), "Current revision of the user's node was not deleted.");

   989     $this->assertFalse(comment_load($comment->cid), 'Comment of the user has been deleted.');

   990 

   991     // Confirm that the confirmation message made it through to the end user.

   992     $this->assertRaw(t('%name has been deleted.', array('%name' => $account->name)), "Confirmation message displayed to user.");

   993   }

   994 

   995   /**

   996    * Create an administrative user and delete another user.

   997    */

   998   function testUserCancelByAdmin() {

   999     variable_set('user_cancel_method', 'user_cancel_reassign');

  1000 

  1001     // Create a regular user.

  1002     $account = $this->drupalCreateUser(array());

  1003 

  1004     // Create administrative user.

  1005     $admin_user = $this->drupalCreateUser(array('administer users'));

  1006     $this->drupalLogin($admin_user);

  1007 

  1008     // Delete regular user.

  1009     $this->drupalGet('user/' . $account->uid . '/edit');

  1010     $this->drupalPost(NULL, NULL, t('Cancel account'));

  1011     $this->assertRaw(t('Are you sure you want to cancel the account %name?', array('%name' => $account->name)), 'Confirmation form to cancel account displayed.');

  1012     $this->assertText(t('Select the method to cancel the account above.'), 'Allows to select account cancellation method.');

  1013 

  1014     // Confirm deletion.

  1015     $this->drupalPost(NULL, NULL, t('Cancel account'));

  1016     $this->assertRaw(t('%name has been deleted.', array('%name' => $account->name)), 'User deleted.');

  1017     $this->assertFalse(user_load($account->uid), 'User is not found in the database.');

  1018   }

  1019 

  1020   /**

  1021    * Create an administrative user and mass-delete other users.

  1022    */

  1023   function testMassUserCancelByAdmin() {

  1024     variable_set('user_cancel_method', 'user_cancel_reassign');

  1025     // Enable account cancellation notification.

  1026     variable_set('user_mail_status_canceled_notify', TRUE);

  1027 

  1028     // Create administrative user.

  1029     $admin_user = $this->drupalCreateUser(array('administer users'));

  1030     $this->drupalLogin($admin_user);

  1031 

  1032     // Create some users.

  1033     $users = array();

  1034     for ($i = 0; $i < 3; $i++) {

  1035       $account = $this->drupalCreateUser(array());

  1036       $users[$account->uid] = $account;

  1037     }

  1038 

  1039     // Cancel user accounts, including own one.

  1040     $edit = array();

  1041     $edit['operation'] = 'cancel';

  1042     foreach ($users as $uid => $account) {

  1043       $edit['accounts[' . $uid . ']'] = TRUE;

  1044     }

  1045     $edit['accounts[' . $admin_user->uid . ']'] = TRUE;

  1046     // Also try to cancel uid 1.

  1047     $edit['accounts[1]'] = TRUE;

  1048     $this->drupalPost('admin/people', $edit, t('Update'));

  1049     $this->assertText(t('Are you sure you want to cancel these user accounts?'), 'Confirmation form to cancel accounts displayed.');

  1050     $this->assertText(t('When cancelling these accounts'), 'Allows to select account cancellation method.');

  1051     $this->assertText(t('Require e-mail confirmation to cancel account.'), 'Allows to send confirmation mail.');

  1052     $this->assertText(t('Notify user when account is canceled.'), 'Allows to send notification mail.');

  1053 

  1054     // Confirm deletion.

  1055     $this->drupalPost(NULL, NULL, t('Cancel accounts'));

  1056     $status = TRUE;

  1057     foreach ($users as $account) {

  1058       $status = $status && (strpos($this->content, t('%name has been deleted.', array('%name' => $account->name))) !== FALSE);

  1059       $status = $status && !user_load($account->uid, TRUE);

  1060     }

  1061     $this->assertTrue($status, 'Users deleted and not found in the database.');

  1062 

  1063     // Ensure that admin account was not cancelled.

  1064     $this->assertText(t('A confirmation request to cancel your account has been sent to your e-mail address.'), 'Account cancellation request mailed message displayed.');

  1065     $admin_user = user_load($admin_user->uid);

  1066     $this->assertTrue($admin_user->status == 1, 'Administrative user is found in the database and enabled.');

  1067 

  1068     // Verify that uid 1's account was not cancelled.

  1069     $user1 = user_load(1, TRUE);

  1070     $this->assertEqual($user1->status, 1, 'User #1 still exists and is not blocked.');

  1071   }

  1072 }

  1073 

  1074 class UserPictureTestCase extends DrupalWebTestCase {

  1075   protected $user;

  1076   protected $_directory_test;

  1077 

  1078   public static function getInfo() {

  1079     return array(

  1080       'name' => 'Upload user picture',

  1081       'description' => 'Assure that dimension check, extension check and image scaling work as designed.',

  1082       'group' => 'User'

  1083     );

  1084   }

  1085 

  1086   function setUp() {

  1087     parent::setUp();

  1088     // Enable user pictures.

  1089     variable_set('user_pictures', 1);

  1090 

  1091     $this->user = $this->drupalCreateUser();

  1092 

  1093     // Test if directories specified in settings exist in filesystem.

  1094     $file_dir = 'public://';

  1095     $file_check = file_prepare_directory($file_dir, FILE_CREATE_DIRECTORY);

  1096     // TODO: Test public and private methods?

  1097 

  1098     $picture_dir = variable_get('user_picture_path', 'pictures');

  1099     $picture_path = $file_dir . $picture_dir;

  1100 

  1101     $pic_check = file_prepare_directory($picture_path, FILE_CREATE_DIRECTORY);

  1102     $this->_directory_test = is_writable($picture_path);

  1103     $this->assertTrue($this->_directory_test, "The directory $picture_path doesn't exist or is not writable. Further tests won't be made.");

  1104   }

  1105 

  1106   function testNoPicture() {

  1107     $this->drupalLogin($this->user);

  1108 

  1109     // Try to upload a file that is not an image for the user picture.

  1110     $not_an_image = current($this->drupalGetTestFiles('html'));

  1111     $this->saveUserPicture($not_an_image);

  1112     $this->assertRaw(t('Only JPEG, PNG and GIF images are allowed.'), 'Non-image files are not accepted.');

  1113   }

  1114 

  1115   /**

  1116    * Do the test:

  1117    *  GD Toolkit is installed

  1118    *  Picture has invalid dimension

  1119    *

  1120    * results: The image should be uploaded because ImageGDToolkit resizes the picture

  1121    */

  1122   function testWithGDinvalidDimension() {

  1123     if ($this->_directory_test && image_get_toolkit()) {

  1124       $this->drupalLogin($this->user);

  1125 

  1126       $image = current($this->drupalGetTestFiles('image'));

  1127       $info = image_get_info($image->uri);

  1128 

  1129       // Set new variables: invalid dimensions, valid filesize (0 = no limit).

  1130       $test_dim = ($info['width'] - 10) . 'x' . ($info['height'] - 10);

  1131       variable_set('user_picture_dimensions', $test_dim);

  1132       variable_set('user_picture_file_size', 0);

  1133 

  1134       $pic_path = $this->saveUserPicture($image);

  1135       // Check that the image was resized and is being displayed on the

  1136       // user's profile page.