get("ControllerTest_Controller/"); $this->assertRegExp("/This is the main template. Content is 'default content'/", $response->getBody()); } public function testMethodActions() { /* The Action can refer to a method that is called on the object. If a method returns an array, then it * will be used to customise the template data */ $response = $this->get("ControllerTest_Controller/methodaction"); $this->assertRegExp("/This is the main template. Content is 'methodaction content'./", $response->getBody()); /* If the method just returns a string, then that will be used as the response */ $response = $this->get("ControllerTest_Controller/stringaction"); $this->assertRegExp("/stringaction was called./", $response->getBody()); } public function testTemplateActions() { /* If there is no method, it can be used to point to an alternative template. */ $response = $this->get("ControllerTest_Controller/templateaction"); $this->assertRegExp("/This is the template for templateaction. Content is 'default content'./", $response->getBody()); } public function testUndefinedActions() { $response = Director::test('ControllerTest_AccessUnsecuredSubController/undefinedaction'); $this->assertEquals(404, $response->getStatusCode(), 'Undefined actions return a not found response.'); } public function testAllowedActions() { $adminUser = $this->objFromFixture('Member', 'admin'); $response = $this->get("ControllerTest_AccessBaseController/unsecuredaction"); $this->assertEquals(200, $response->getStatusCode(), 'Access granted on action without $allowed_actions on defining controller' ); $response = $this->get("ControllerTest_AccessBaseController/onlysecuredinsubclassaction"); $this->assertEquals(200, $response->getStatusCode(), 'Access granted on action without $allowed_actions on defining controller, ' . 'even when action is secured in subclasses' ); $response = $this->get("ControllerTest_AccessSecuredController/onlysecuredinsubclassaction"); $this->assertEquals(403, $response->getStatusCode(), 'Access denied on action with $allowed_actions on defining controller, ' . 'even if action is unsecured on parent class' ); $response = $this->get("ControllerTest_AccessSecuredController/templateaction"); $this->assertEquals(403, $response->getStatusCode(), 'Access denied on action with $allowed_actions on defining controller, ' . 'if action is not a method but rather a template discovered by naming convention' ); $this->session()->inst_set('loggedInAs', $adminUser->ID); $response = $this->get("ControllerTest_AccessSecuredController/templateaction"); $this->assertEquals(200, $response->getStatusCode(), 'Access granted for logged in admin on action with $allowed_actions on defining controller, ' . 'if action is not a method but rather a template discovered by naming convention' ); $this->session()->inst_set('loggedInAs', null); $response = $this->get("ControllerTest_AccessSecuredController/adminonly"); $this->assertEquals(403, $response->getStatusCode(), 'Access denied on action with $allowed_actions on defining controller, ' . 'when action is not defined on any parent classes' ); $response = $this->get("ControllerTest_AccessSecuredController/aDmiNOnlY"); $this->assertEquals(403, $response->getStatusCode(), 'Access denied on action with $allowed_actions on defining controller, ' . 'regardless of capitalization' ); // TODO Change this API $response = $this->get('ControllerTest_AccessUnsecuredSubController/unsecuredaction'); $this->assertEquals(200, $response->getStatusCode(), "Controller without a specified allowed_actions allows its own actions through" ); $response = $this->get('ControllerTest_AccessUnsecuredSubController/adminonly'); $this->assertEquals(403, $response->getStatusCode(), "Controller without a specified allowed_actions still disallows actions defined on parents" ); $response = $this->get("ControllerTest_AccessAsteriskSecuredController/index"); $this->assertEquals(403, $response->getStatusCode(), "Actions can be globally disallowed by using asterisk (*) for index method" ); $response = $this->get("ControllerTest_AccessAsteriskSecuredController/onlysecuredinsubclassaction"); $this->assertEquals(404, $response->getStatusCode(), "Actions can be globally disallowed by using asterisk (*) instead of a method name, " . "in which case they'll be marked as 'not found'" ); $response = $this->get("ControllerTest_AccessAsteriskSecuredController/unsecuredaction"); $this->assertEquals(200, $response->getStatusCode(), "Actions can be overridden to be allowed if globally disallowed by using asterisk (*)" ); $this->session()->inst_set('loggedInAs', $adminUser->ID); $response = $this->get("ControllerTest_AccessSecuredController/adminonly"); $this->assertEquals( 200, $response->getStatusCode(), "Permission codes are respected when set in \$allowed_actions" ); $response = $this->get("ControllerTest_AccessUnsecuredSubController/adminonly"); $this->assertEquals(200, $response->getStatusCode(), "Actions can be globally disallowed by using asterisk (*) instead of a method name" ); $this->session()->inst_set('loggedInAs', null); } /** * Test Controller::join_links() */ public function testJoinLinks() { /* Controller::join_links() will reliably join two URL-segments together so that they will be * appropriately parsed by the URL parser */ $this->assertEquals("admin/crm/MyForm", Controller::join_links("admin/crm", "MyForm")); $this->assertEquals("admin/crm/MyForm", Controller::join_links("admin/crm/", "MyForm")); /* It will also handle appropriate combination of querystring variables */ $this->assertEquals("admin/crm/MyForm?flush=1", Controller::join_links("admin/crm/?flush=1", "MyForm")); $this->assertEquals("admin/crm/MyForm?flush=1", Controller::join_links("admin/crm/", "MyForm?flush=1")); $this->assertEquals("admin/crm/MyForm?field=1&other=1", Controller::join_links("admin/crm/?field=1", "MyForm?other=1")); /* It can handle arbitrary numbers of components, and will ignore empty ones */ $this->assertEquals("admin/crm/MyForm/", Controller::join_links("admin/", "crm", "", "MyForm/")); $this->assertEquals("admin/crm/MyForm/?a=1&b=2", Controller::join_links("admin/?a=1", "crm", "", "MyForm/?b=2")); /* It can also be used to attach additional get variables to a link */ $this->assertEquals("admin/crm?flush=1", Controller::join_links("admin/crm", "?flush=1")); $this->assertEquals("admin/crm?existing=1&flush=1", Controller::join_links("admin/crm?existing=1", "?flush=1")); $this->assertEquals("admin/crm/MyForm?a=1&b=2&c=3", Controller::join_links("?a=1", "admin/crm", "?b=2", "MyForm?c=3")); /* Note, however, that it doesn't deal with duplicates very well. */ $this->assertEquals("admin/crm?flush=1&flush=1", Controller::join_links("admin/crm?flush=1", "?flush=1")); $this->assertEquals ( 'admin/action', Controller::join_links('admin/', '/', '/action'), 'Test that multiple slashes are trimmed.' ); $this->assertEquals('/admin/action', Controller::join_links('/admin', 'action')); /* One fragment identifier is handled as you would expect */ $this->assertEquals("my-page?arg=var#subsection", Controller::join_links("my-page#subsection", "?arg=var")); /* If there are multiple, it takes the last one */ $this->assertEquals("my-page?arg=var#second-section", Controller::join_links("my-page#subsection", "?arg=var", "#second-section")); /* Does type-safe checks for zero value */ $this->assertEquals("my-page/0", Controller::join_links("my-page", 0)); } /** * @covers Controller::hasAction */ public function testHasAction() { $controller = new ControllerTest_HasAction(); $this->assertFalse($controller->hasAction('1'), 'Numeric actions do not slip through.'); //$this->assertFalse($controller->hasAction('lowercase_permission'), //'Lowercase permission does not slip through.'); $this->assertFalse($controller->hasAction('undefined'), 'undefined actions do not exist'); $this->assertTrue($controller->hasAction('allowed_action'), 'allowed actions are recognised'); $this->assertTrue($controller->hasAction('template_action'), 'action-specific templates are recognised'); $unsecured = new ControllerTest_HasAction_Unsecured(); $this->assertTrue ( $unsecured->hasAction('defined_action'), 'Without an allowed_actions, any defined methods are recognised as actions' ); } /* Controller::BaseURL no longer exists, but was just a direct call to Director::BaseURL, so not sure what this * code was supposed to test public function testBaseURL() { Director::setBaseURL('/baseurl/'); $this->assertEquals(Controller::BaseURL(), Director::BaseURL()); } */ public function testRedirectBackByReferer() { $internalRelativeUrl = '/some-url'; $response = $this->get('ControllerTest_Controller/redirectbacktest', null, array('Referer' => $internalRelativeUrl)); $this->assertEquals(302, $response->getStatusCode()); $this->assertEquals($internalRelativeUrl, $response->getHeader('Location'), "Redirects on internal relative URLs" ); $internalAbsoluteUrl = Director::absoluteBaseURL() . '/some-url'; $response = $this->get('ControllerTest_Controller/redirectbacktest', null, array('Referer' => $internalAbsoluteUrl)); $this->assertEquals(302, $response->getStatusCode()); $this->assertEquals($internalAbsoluteUrl, $response->getHeader('Location'), "Redirects on internal absolute URLs" ); $externalAbsoluteUrl = 'http://myhost.com/some-url'; $response = $this->get('ControllerTest_Controller/redirectbacktest', null, array('Referer' => $externalAbsoluteUrl)); $this->assertEquals(200, $response->getStatusCode(), "Doesn't redirect on external URLs" ); } public function testRedirectBackByBackUrl() { $internalRelativeUrl = '/some-url'; $response = $this->get('ControllerTest_Controller/redirectbacktest?BackURL=' . urlencode($internalRelativeUrl)); $this->assertEquals(302, $response->getStatusCode()); $this->assertEquals($internalRelativeUrl, $response->getHeader('Location'), "Redirects on internal relative URLs" ); $internalAbsoluteUrl = Director::absoluteBaseURL() . '/some-url'; $response = $this->get('ControllerTest_Controller/redirectbacktest?BackURL=' . urlencode($internalAbsoluteUrl)); $this->assertEquals($internalAbsoluteUrl, $response->getHeader('Location')); $this->assertEquals(302, $response->getStatusCode(), "Redirects on internal absolute URLs" ); $externalAbsoluteUrl = 'http://myhost.com/some-url'; $response = $this->get('ControllerTest_Controller/redirectbacktest?BackURL=' . urlencode($externalAbsoluteUrl)); $this->assertEquals(200, $response->getStatusCode(), "Doesn't redirect on external URLs" ); } } /** * Simple controller for testing */ class ControllerTest_Controller extends Controller implements TestOnly { public $Content = "default content"; public function methodaction() { return array( "Content" => "methodaction content" ); } public function stringaction() { return "stringaction was called."; } public function redirectbacktest() { return $this->redirectBack(); } } /** * Allowed actions flattened: * - unsecuredaction: * * - onlysecuredinsubclassaction: * * - unsecuredinparentclassaction: * * - unsecuredinsubclassaction: * */ class ControllerTest_AccessBaseController extends Controller implements TestOnly { // Accessible by all public function unsecuredaction() { return 'unsecuredaction was called.'; } // Accessible by all public function onlysecuredinsubclassaction() { return 'onlysecuredinsubclass was called.'; } // Accessible by all public function unsecuredinparentclassaction() { return 'unsecuredinparentclassaction was called.'; } // Accessible by all public function unsecuredinsubclassaction() { return 'unsecuredinsubclass was called.'; } } /** * Allowed actions flattened: * - unsecuredaction: * * - onlysecuredinsubclassaction: ADMIN (parent: *) * - unsecuredinparentclassaction: * * - unsecuredinsubclassaction: (none) (parent: *) * - adminonly: ADMIN */ class ControllerTest_AccessSecuredController extends ControllerTest_AccessBaseController implements TestOnly { static $allowed_actions = array( "onlysecuredinsubclassaction" => 'ADMIN', "adminonly" => "ADMIN", // Defined as ControllerTest_templateaction 'templateaction' => 'ADMIN' ); protected $templates = array( 'templateaction' => 'ControllerTest_templateaction' ); // Accessible by ADMIN only public function onlysecuredinsubclassaction() { return 'onlysecuredinsubclass was called.'; } // Not accessible, since overloaded but not mentioned in $allowed_actions public function unsecuredinsubclassaction() { return 'unsecuredinsubclass was called.'; } // Accessible by all, since only defined in parent class //public function unsecuredinparentclassaction() { // Accessible by ADMIN only public function adminonly() { return "You must be an admin!"; } } /** * Allowed actions flattened: * - unsecuredaction: * * - onlysecuredinsubclassaction: ADMIN (parent: *) * - unsecuredinparentclassaction: ADMIN (parent: *) * - unsecuredinsubclassaction: (none) (parent: *) * - adminonly: ADMIN (parent: ADMIN) */ class ControllerTest_AccessAsteriskSecuredController extends ControllerTest_AccessBaseController implements TestOnly { static $allowed_actions = array( "*" => "ADMIN", 'unsecuredaction' => true, ); // Accessible by ADMIN only public function adminonly() { return "You must be an admin!"; } // Accessible by all public function unsecuredaction() { return "Allowed for everybody"; } } /** * Allowed actions flattened: * - unsecuredaction: * * - onlysecuredinsubclassaction: ADMIN (parent: *) * - unsecuredinparentclassaction: * * - unsecuredinsubclassaction: (none) (parent: *) * - adminonly: ADMIN */ class ControllerTest_AccessUnsecuredSubController extends ControllerTest_AccessSecuredController implements TestOnly { // No $allowed_actions defined here // Accessible by ADMIN only, defined in parent class public function onlysecuredinsubclassaction() { return 'onlysecuredinsubclass was called.'; } } class ControllerTest_HasAction extends Controller { public static $allowed_actions = array ( 'allowed_action', //'other_action' => 'lowercase_permission' ); protected $templates = array ( 'template_action' => 'template' ); } class ControllerTest_HasAction_Unsecured extends ControllerTest_HasAction implements TestOnly { public function defined_action() { } }