2010-10-19 00:29:35 +02:00
|
|
|
<?php
|
2016-06-23 01:37:22 +02:00
|
|
|
|
2016-10-14 03:30:05 +02:00
|
|
|
namespace SilverStripe\Security\Tests;
|
|
|
|
|
2016-06-23 01:37:22 +02:00
|
|
|
use SilverStripe\Security\Member;
|
|
|
|
use SilverStripe\Security\Security;
|
2016-08-19 00:51:35 +02:00
|
|
|
use SilverStripe\Dev\FunctionalTest;
|
|
|
|
use SilverStripe\Control\Director;
|
2016-10-14 03:30:05 +02:00
|
|
|
use SilverStripe\Security\Tests\BasicAuthTest\ControllerSecuredWithoutPermission;
|
|
|
|
use SilverStripe\Security\Tests\BasicAuthTest\ControllerSecuredWithPermission;
|
2016-08-19 00:51:35 +02:00
|
|
|
|
2010-10-19 00:29:35 +02:00
|
|
|
/**
|
2016-08-19 00:51:35 +02:00
|
|
|
* @skipUpgrade
|
2010-10-19 00:29:35 +02:00
|
|
|
*/
|
2016-12-16 05:34:21 +01:00
|
|
|
class BasicAuthTest extends FunctionalTest
|
|
|
|
{
|
|
|
|
|
2017-05-20 06:32:25 +02:00
|
|
|
protected static $original_unique_identifier_field;
|
2016-12-16 05:34:21 +01:00
|
|
|
|
|
|
|
protected static $fixture_file = 'BasicAuthTest.yml';
|
|
|
|
|
2017-03-24 12:17:26 +01:00
|
|
|
protected static $extra_controllers = [
|
2016-12-16 05:34:21 +01:00
|
|
|
ControllerSecuredWithPermission::class,
|
|
|
|
ControllerSecuredWithoutPermission::class,
|
|
|
|
];
|
|
|
|
|
2017-03-24 04:00:54 +01:00
|
|
|
protected function setUp()
|
2016-12-16 05:34:21 +01:00
|
|
|
{
|
|
|
|
parent::setUp();
|
|
|
|
|
|
|
|
// Fixtures assume Email is the field used to identify the log in identity
|
|
|
|
Member::config()->unique_identifier_field = 'Email';
|
2017-04-23 05:30:33 +02:00
|
|
|
Security::force_database_is_ready(true); // Prevents Member test subclasses breaking ready test
|
2016-12-16 05:34:21 +01:00
|
|
|
Member::config()->lock_out_after_incorrect_logins = 10;
|
|
|
|
}
|
|
|
|
|
|
|
|
public function testBasicAuthEnabledWithoutLogin()
|
|
|
|
{
|
|
|
|
$origUser = isset($_SERVER['PHP_AUTH_USER']) ? $_SERVER['PHP_AUTH_USER'] : null;
|
|
|
|
$origPw = isset($_SERVER['PHP_AUTH_PW']) ? $_SERVER['PHP_AUTH_PW'] : null;
|
|
|
|
|
|
|
|
unset($_SERVER['PHP_AUTH_USER']);
|
|
|
|
unset($_SERVER['PHP_AUTH_PW']);
|
|
|
|
|
2017-05-20 06:32:25 +02:00
|
|
|
$response = Director::test('BasicAuthTest_ControllerSecuredWithPermission', null, $_SESSION, null, null, $_SERVER);
|
2016-12-16 05:34:21 +01:00
|
|
|
$this->assertEquals(401, $response->getStatusCode());
|
|
|
|
|
|
|
|
$_SERVER['PHP_AUTH_USER'] = $origUser;
|
|
|
|
$_SERVER['PHP_AUTH_PW'] = $origPw;
|
|
|
|
}
|
|
|
|
|
|
|
|
public function testBasicAuthDoesntCallActionOrFurtherInitOnAuthFailure()
|
|
|
|
{
|
|
|
|
$origUser = isset($_SERVER['PHP_AUTH_USER']) ? $_SERVER['PHP_AUTH_USER'] : null;
|
|
|
|
$origPw = isset($_SERVER['PHP_AUTH_PW']) ? $_SERVER['PHP_AUTH_PW'] : null;
|
|
|
|
|
|
|
|
unset($_SERVER['PHP_AUTH_USER']);
|
|
|
|
unset($_SERVER['PHP_AUTH_PW']);
|
2017-05-20 06:32:25 +02:00
|
|
|
$response = Director::test('BasicAuthTest_ControllerSecuredWithPermission', null, $_SESSION, null, null, $_SERVER);
|
2016-12-16 05:34:21 +01:00
|
|
|
$this->assertFalse(BasicAuthTest\ControllerSecuredWithPermission::$index_called);
|
|
|
|
$this->assertFalse(BasicAuthTest\ControllerSecuredWithPermission::$post_init_called);
|
|
|
|
|
|
|
|
$_SERVER['PHP_AUTH_USER'] = 'user-in-mygroup@test.com';
|
|
|
|
$_SERVER['PHP_AUTH_PW'] = 'test';
|
2017-05-20 06:32:25 +02:00
|
|
|
$response = Director::test('BasicAuthTest_ControllerSecuredWithPermission', null, $_SESSION, null, null, $_SERVER);
|
2016-12-16 05:34:21 +01:00
|
|
|
$this->assertTrue(BasicAuthTest\ControllerSecuredWithPermission::$index_called);
|
|
|
|
$this->assertTrue(BasicAuthTest\ControllerSecuredWithPermission::$post_init_called);
|
|
|
|
|
|
|
|
$_SERVER['PHP_AUTH_USER'] = $origUser;
|
|
|
|
$_SERVER['PHP_AUTH_PW'] = $origPw;
|
|
|
|
}
|
|
|
|
|
|
|
|
public function testBasicAuthEnabledWithPermission()
|
|
|
|
{
|
|
|
|
$origUser = isset($_SERVER['PHP_AUTH_USER']) ? $_SERVER['PHP_AUTH_USER'] : null;
|
|
|
|
$origPw = isset($_SERVER['PHP_AUTH_PW']) ? $_SERVER['PHP_AUTH_PW'] : null;
|
|
|
|
|
|
|
|
$_SERVER['PHP_AUTH_USER'] = 'user-in-mygroup@test.com';
|
|
|
|
$_SERVER['PHP_AUTH_PW'] = 'wrongpassword';
|
2017-05-20 06:32:25 +02:00
|
|
|
$response = Director::test('BasicAuthTest_ControllerSecuredWithPermission', null, $_SESSION, null, null, $_SERVER);
|
2016-12-16 05:34:21 +01:00
|
|
|
$this->assertEquals(401, $response->getStatusCode(), 'Invalid users dont have access');
|
|
|
|
|
|
|
|
$_SERVER['PHP_AUTH_USER'] = 'user-without-groups@test.com';
|
|
|
|
$_SERVER['PHP_AUTH_PW'] = 'test';
|
2017-05-20 06:32:25 +02:00
|
|
|
$response = Director::test('BasicAuthTest_ControllerSecuredWithPermission', null, $_SESSION, null, null, $_SERVER);
|
2016-12-16 05:34:21 +01:00
|
|
|
$this->assertEquals(401, $response->getStatusCode(), 'Valid user without required permission has no access');
|
|
|
|
|
|
|
|
$_SERVER['PHP_AUTH_USER'] = 'user-in-mygroup@test.com';
|
|
|
|
$_SERVER['PHP_AUTH_PW'] = 'test';
|
2017-05-30 09:42:00 +02:00
|
|
|
$response = Director::test('BasicAuthTest_ControllerSecuredWithPermission', null, $_SESSION, null, null, $_SERVER);
|
2016-12-16 05:34:21 +01:00
|
|
|
$this->assertEquals(200, $response->getStatusCode(), 'Valid user with required permission has access');
|
|
|
|
|
|
|
|
$_SERVER['PHP_AUTH_USER'] = $origUser;
|
|
|
|
$_SERVER['PHP_AUTH_PW'] = $origPw;
|
|
|
|
}
|
|
|
|
|
|
|
|
public function testBasicAuthEnabledWithoutPermission()
|
|
|
|
{
|
|
|
|
$origUser = isset($_SERVER['PHP_AUTH_USER']) ? $_SERVER['PHP_AUTH_USER'] : null;
|
|
|
|
$origPw = isset($_SERVER['PHP_AUTH_PW']) ? $_SERVER['PHP_AUTH_PW'] : null;
|
|
|
|
|
|
|
|
$_SERVER['PHP_AUTH_USER'] = 'user-without-groups@test.com';
|
|
|
|
$_SERVER['PHP_AUTH_PW'] = 'wrongpassword';
|
2017-05-20 06:32:25 +02:00
|
|
|
$response = Director::test('BasicAuthTest_ControllerSecuredWithoutPermission', null, $_SESSION, null, null, $_SERVER);
|
2016-12-16 05:34:21 +01:00
|
|
|
$this->assertEquals(401, $response->getStatusCode(), 'Invalid users dont have access');
|
|
|
|
|
|
|
|
$_SERVER['PHP_AUTH_USER'] = 'user-without-groups@test.com';
|
|
|
|
$_SERVER['PHP_AUTH_PW'] = 'test';
|
2017-05-20 06:32:25 +02:00
|
|
|
$response = Director::test('BasicAuthTest_ControllerSecuredWithoutPermission', null, $_SESSION, null, null, $_SERVER);
|
2016-12-16 05:34:21 +01:00
|
|
|
$this->assertEquals(200, $response->getStatusCode(), 'All valid users have access');
|
|
|
|
|
|
|
|
$_SERVER['PHP_AUTH_USER'] = 'user-in-mygroup@test.com';
|
|
|
|
$_SERVER['PHP_AUTH_PW'] = 'test';
|
2017-05-20 06:32:25 +02:00
|
|
|
$response = Director::test('BasicAuthTest_ControllerSecuredWithoutPermission', null, $_SESSION, null, null, $_SERVER);
|
2016-12-16 05:34:21 +01:00
|
|
|
$this->assertEquals(200, $response->getStatusCode(), 'All valid users have access');
|
|
|
|
|
|
|
|
$_SERVER['PHP_AUTH_USER'] = $origUser;
|
|
|
|
$_SERVER['PHP_AUTH_PW'] = $origPw;
|
|
|
|
}
|
|
|
|
|
|
|
|
public function testBasicAuthFailureIncreasesFailedLoginCount()
|
|
|
|
{
|
|
|
|
// Prior to login
|
|
|
|
$check = Member::get()->filter('Email', 'failedlogin@test.com')->first();
|
|
|
|
$this->assertEquals(0, $check->FailedLoginCount);
|
|
|
|
|
|
|
|
// First failed attempt
|
|
|
|
$_SERVER['PHP_AUTH_USER'] = 'failedlogin@test.com';
|
|
|
|
$_SERVER['PHP_AUTH_PW'] = 'test';
|
2017-05-20 06:32:25 +02:00
|
|
|
$response = Director::test('BasicAuthTest_ControllerSecuredWithoutPermission', null, $_SESSION, null, null, $_SERVER);
|
2016-12-16 05:34:21 +01:00
|
|
|
$check = Member::get()->filter('Email', 'failedlogin@test.com')->first();
|
|
|
|
$this->assertEquals(1, $check->FailedLoginCount);
|
|
|
|
|
|
|
|
// Second failed attempt
|
|
|
|
$_SERVER['PHP_AUTH_PW'] = 'testwrong';
|
2017-05-20 06:32:25 +02:00
|
|
|
$response = Director::test('BasicAuthTest_ControllerSecuredWithoutPermission', null, $_SESSION, null, null, $_SERVER);
|
2016-12-16 05:34:21 +01:00
|
|
|
$check = Member::get()->filter('Email', 'failedlogin@test.com')->first();
|
|
|
|
$this->assertEquals(2, $check->FailedLoginCount);
|
|
|
|
|
|
|
|
// successful basic auth should reset failed login count
|
|
|
|
$_SERVER['PHP_AUTH_PW'] = 'Password';
|
2017-05-20 06:32:25 +02:00
|
|
|
$response = Director::test('BasicAuthTest_ControllerSecuredWithoutPermission', null, $_SESSION, null, null, $_SERVER);
|
2016-12-16 05:34:21 +01:00
|
|
|
$check = Member::get()->filter('Email', 'failedlogin@test.com')->first();
|
|
|
|
$this->assertEquals(0, $check->FailedLoginCount);
|
|
|
|
}
|
2010-10-19 00:29:35 +02:00
|
|
|
}
|