set('alternate_base_url', '/'); // Add test theme $themeDir = substr(__DIR__, strlen(FRAMEWORK_DIR)) . '/ControllerTest/'; $themes = [ "silverstripe/framework:{$themeDir}", SSViewer::DEFAULT_THEME, ]; SSViewer::set_themes($themes); } public function testDefaultAction() { /* For a controller with a template, the default action will simple run that template. */ $response = $this->get("TestController/"); $this->assertStringContainsString("This is the main template. Content is 'default content'", $response->getBody()); } public function testMethodActions() { /* The Action can refer to a method that is called on the object. If a method returns an array, then it * will be used to customise the template data */ $response = $this->get("TestController/methodaction"); $this->assertStringContainsString("This is the main template. Content is 'methodaction content'.", $response->getBody()); /* If the method just returns a string, then that will be used as the response */ $response = $this->get("TestController/stringaction"); $this->assertStringContainsString("stringaction was called.", $response->getBody()); } public function testTemplateActions() { /* If there is no method, it can be used to point to an alternative template. */ $response = $this->get("TestController/templateaction"); $this->assertStringContainsString( "This is the template for templateaction. Content is 'default content'.", $response->getBody() ); } public function testUndefinedActions() { $response = $this->get('IndexSecuredController/undefinedaction'); $this->assertInstanceOf('SilverStripe\\Control\\HTTPResponse', $response); $this->assertEquals(404, $response->getStatusCode(), 'Undefined actions return a not found response.'); } public function testAllowedActions() { $response = $this->get("UnsecuredController/"); $this->assertEquals( 200, $response->getStatusCode(), 'Access granted on index action without $allowed_actions on defining controller, ' . 'when called without an action in the URL' ); $response = $this->get("UnsecuredController/index"); $this->assertEquals( 200, $response->getStatusCode(), 'Access denied on index action without $allowed_actions on defining controller, ' . 'when called with an action in the URL' ); $response = $this->get("UnsecuredController/method1"); $this->assertEquals( 403, $response->getStatusCode(), 'Access denied on action without $allowed_actions on defining controller, ' . 'when called without an action in the URL' ); $response = $this->get("AccessBaseController/"); $this->assertEquals( 200, $response->getStatusCode(), 'Access granted on index with empty $allowed_actions on defining controller, ' . 'when called without an action in the URL' ); $response = $this->get("AccessBaseController/index"); $this->assertEquals( 200, $response->getStatusCode(), 'Access granted on index with empty $allowed_actions on defining controller, ' . 'when called with an action in the URL' ); $response = $this->get("AccessBaseController/method1"); $this->assertEquals( 403, $response->getStatusCode(), 'Access denied on action with empty $allowed_actions on defining controller' ); $response = $this->get("AccessBaseController/method2"); $this->assertEquals( 403, $response->getStatusCode(), 'Access denied on action with empty $allowed_actions on defining controller, ' . 'even when action is allowed in subclasses (allowed_actions don\'t inherit)' ); $response = $this->get("AccessSecuredController/"); $this->assertEquals( 200, $response->getStatusCode(), 'Access granted on index with non-empty $allowed_actions on defining controller, ' . 'even when index isn\'t specifically mentioned in there' ); $response = $this->get("AccessSecuredController/method1"); $this->assertEquals( 403, $response->getStatusCode(), 'Access denied on action which is only defined in parent controller, ' . 'even when action is allowed in currently called class (allowed_actions don\'t inherit)' ); $response = $this->get("AccessSecuredController/method2"); $this->assertEquals( 200, $response->getStatusCode(), 'Access granted on action originally defined with empty $allowed_actions on parent controller, ' . 'because it has been redefined in the subclass' ); $response = $this->get("AccessSecuredController/templateaction"); $this->assertEquals( 403, $response->getStatusCode(), 'Access denied on action with $allowed_actions on defining controller, ' . 'if action is not a method but rather a template discovered by naming convention' ); $response = $this->get("AccessSecuredController/templateaction"); $this->assertEquals( 403, $response->getStatusCode(), 'Access denied on action with $allowed_actions on defining controller, ' . 'if action is not a method but rather a template discovered by naming convention' ); $this->logInAs('admin'); $response = $this->get("AccessSecuredController/templateaction"); $this->assertEquals( 200, $response->getStatusCode(), 'Access granted for logged in admin on action with $allowed_actions on defining controller, ' . 'if action is not a method but rather a template discovered by naming convention' ); $this->logOut(); $response = $this->get("AccessSecuredController/adminonly"); $this->assertEquals( 403, $response->getStatusCode(), 'Access denied on action with $allowed_actions on defining controller, ' . 'when restricted by unmatched permission code' ); $response = $this->get("AccessSecuredController/aDmiNOnlY"); $this->assertEquals( 403, $response->getStatusCode(), 'Access denied on action with $allowed_actions on defining controller, ' . 'regardless of capitalization' ); $response = $this->get('AccessSecuredController/protectedmethod'); $this->assertEquals( 404, $response->getStatusCode(), "Access denied to protected method even if its listed in allowed_actions" ); $this->logInAs('admin'); $response = $this->get("AccessSecuredController/adminonly"); $this->assertEquals( 200, $response->getStatusCode(), "Permission codes are respected when set in \$allowed_actions" ); $this->logOut(); $response = $this->get('AccessBaseController/extensionmethod1'); $this->assertEquals( 200, $response->getStatusCode(), "Access granted to method defined in allowed_actions on extension, " . "where method is also defined on extension" ); $response = $this->get('AccessSecuredController/extensionmethod1'); $this->assertEquals( 200, $response->getStatusCode(), "Access granted to method defined in allowed_actions on extension, " . "where method is also defined on extension, even when called in a subclass" ); $response = $this->get('AccessBaseController/extensionmethod2'); $this->assertEquals( 404, $response->getStatusCode(), "Access denied to method not defined in allowed_actions on extension, " . "where method is also defined on extension" ); $response = $this->get('IndexSecuredController/'); $this->assertEquals( 403, $response->getStatusCode(), "Access denied when index action is limited through allowed_actions, " . "and doesn't satisfy checks, and action is empty" ); $response = $this->get('IndexSecuredController/index'); $this->assertEquals( 403, $response->getStatusCode(), "Access denied when index action is limited through allowed_actions, " . "and doesn't satisfy checks" ); $this->logInAs('admin'); $response = $this->get('IndexSecuredController/'); $this->assertEquals( 200, $response->getStatusCode(), "Access granted when index action is limited through allowed_actions, " . "and does satisfy checks" ); $this->logOut(); } public function testWildcardAllowedActions() { $this->expectException(\InvalidArgumentException::class); $this->expectExceptionMessage("Invalid allowed_action '*'"); $this->get('AccessWildcardSecuredController'); } /** * Test Controller::join_links() */ public function testJoinLinks() { /* Controller::join_links() will reliably join two URL-segments together so that they will be * appropriately parsed by the URL parser */ $this->assertEquals("admin/crm/MyForm", Controller::join_links("admin/crm", "MyForm")); $this->assertEquals("admin/crm/MyForm", Controller::join_links("admin/crm/", "MyForm")); /* It will also handle appropriate combination of querystring variables */ $this->assertEquals("admin/crm/MyForm?flush=1", Controller::join_links("admin/crm/?flush=1", "MyForm")); $this->assertEquals("admin/crm/MyForm?flush=1", Controller::join_links("admin/crm/", "MyForm?flush=1")); $this->assertEquals( "admin/crm/MyForm?field=1&other=1", Controller::join_links("admin/crm/?field=1", "MyForm?other=1") ); /* It can handle arbitrary numbers of components, and will ignore empty ones */ $this->assertEquals("admin/crm/MyForm/", Controller::join_links("admin/", "crm", "", "MyForm/")); $this->assertEquals( "admin/crm/MyForm/?a=1&b=2", Controller::join_links("admin/?a=1", "crm", "", "MyForm/?b=2") ); /* It can also be used to attach additional get variables to a link */ $this->assertEquals("admin/crm?flush=1", Controller::join_links("admin/crm", "?flush=1")); $this->assertEquals("admin/crm?existing=1&flush=1", Controller::join_links("admin/crm?existing=1", "?flush=1")); $this->assertEquals( "admin/crm/MyForm?a=1&b=2&c=3", Controller::join_links("?a=1", "admin/crm", "?b=2", "MyForm?c=3") ); // And duplicates are handled nicely $this->assertEquals( "admin/crm?foo=2&bar=3&baz=1", Controller::join_links("admin/crm?foo=1&bar=1&baz=1", "?foo=2&bar=3") ); $this->assertEquals( 'admin/action', Controller::join_links('admin/', '/', '/action'), 'Test that multiple slashes are trimmed.' ); $this->assertEquals('/admin/action', Controller::join_links('/admin', 'action')); /* One fragment identifier is handled as you would expect */ $this->assertEquals("my-page?arg=var#subsection", Controller::join_links("my-page#subsection", "?arg=var")); /* If there are multiple, it takes the last one */ $this->assertEquals( "my-page?arg=var#second-section", Controller::join_links("my-page#subsection", "?arg=var", "#second-section") ); /* Does type-safe checks for zero value */ $this->assertEquals("my-page/0", Controller::join_links("my-page", 0)); // Test array args $this->assertEquals( "admin/crm/MyForm?a=1&b=2&c=3", Controller::join_links(["?a=1", "admin/crm", "?b=2", "MyForm?c=3"]) ); } public function testLink() { $controller = new HasAction(); $this->assertEquals('HasAction/', $controller->Link()); $this->assertEquals('HasAction/', $controller->Link(null)); $this->assertEquals('HasAction/', $controller->Link(false)); $this->assertEquals('HasAction/allowed-action/', $controller->Link('allowed-action')); } /** * @covers \SilverStripe\Control\Controller::hasAction */ public function testHasAction() { $controller = new HasAction(); $unsecuredController = new HasAction_Unsecured(); $securedController = new AccessSecuredController(); $this->assertFalse( $controller->hasAction('1'), 'Numeric actions do not slip through.' ); //$this->assertFalse( // $controller->hasAction('lowercase_permission'), // 'Lowercase permission does not slip through.' //); $this->assertFalse( $controller->hasAction('undefined'), 'undefined actions do not exist' ); $this->assertTrue( $controller->hasAction('allowed_action'), 'allowed actions are recognised' ); $this->assertTrue( $controller->hasAction('template_action'), 'action-specific templates are recognised' ); $this->assertTrue( $unsecuredController->hasAction('defined_action'), 'Without an allowed_actions, any defined methods are recognised as actions' ); $this->assertTrue( $securedController->hasAction('adminonly'), 'Method is generally visible even if its denied via allowed_actions' ); $this->assertFalse( $securedController->hasAction('protectedmethod'), 'Method is not visible when protected, even if its defined in allowed_actions' ); $this->assertTrue( $securedController->hasAction('extensionmethod1'), 'Method is visible when defined on an extension and part of allowed_actions' ); $this->assertFalse( $securedController->hasAction('internalextensionmethod'), 'Method is not visible when defined on an extension, but not part of allowed_actions' ); $this->assertFalse( $securedController->hasAction('protectedextensionmethod'), 'Method is not visible when defined on an extension, part of allowed_actions, ' . 'but with protected visibility' ); } public function testRedirectBackByReferer() { $internalRelativeUrl = Controller::join_links(Director::baseURL(), '/some-url'); $internalAbsoluteUrl = Controller::join_links(Director::absoluteBaseURL(), '/some-url'); $response = $this->get( 'TestController/redirectbacktest', null, ['Referer' => $internalRelativeUrl] ); $this->assertEquals(302, $response->getStatusCode()); $this->assertEquals( $internalAbsoluteUrl, $response->getHeader('Location'), "Redirects on internal relative URLs" ); $response = $this->get( 'TestController/redirectbacktest', null, ['Referer' => $internalAbsoluteUrl] ); $this->assertEquals(302, $response->getStatusCode()); $this->assertEquals( $internalAbsoluteUrl, $response->getHeader('Location'), "Redirects on internal absolute URLs" ); $externalAbsoluteUrl = 'http://myhost.com/some-url'; $response = $this->get( 'TestController/redirectbacktest', null, ['Referer' => $externalAbsoluteUrl] ); $this->assertEquals( Director::absoluteBaseURL(), $response->getHeader('Location'), "Redirects back to home page on external url" ); } public function testRedirectBackByBackUrl() { $internalRelativeUrl = Controller::join_links(Director::baseURL(), '/some-url'); $internalAbsoluteUrl = Controller::join_links(Director::absoluteBaseURL(), '/some-url'); $response = $this->get('TestController/redirectbacktest?BackURL=' . urlencode($internalRelativeUrl ?? '')); $this->assertEquals(302, $response->getStatusCode()); $this->assertEquals( $internalAbsoluteUrl, $response->getHeader('Location'), "Redirects on internal relative URLs" ); // BackURL is internal link $internalAbsoluteUrl = Director::absoluteBaseURL() . '/some-url'; $link = 'TestController/redirectbacktest?BackURL=' . urlencode($internalAbsoluteUrl ?? ''); $response = $this->get($link); $this->assertEquals($internalAbsoluteUrl, $response->getHeader('Location')); $this->assertEquals( 302, $response->getStatusCode(), "Redirects on internal absolute URLs" ); // Note that this test is affected by the prior ->get() $externalAbsoluteUrl = 'http://myhost.com/some-url'; $response = $this->get('TestController/redirectbacktest?BackURL=' . urlencode($externalAbsoluteUrl ?? '')); $this->assertEquals( Director::absoluteURL($link), $response->getHeader('Location'), "If BackURL Is external link, fall back to last url (Referer)" ); } public function testSubActions() { // If a controller action returns another controller, ensure that the $action variable is correctly forwarded $response = $this->get("ContainerController/subcontroller/subaction"); $this->assertEquals('subaction', $response->getBody()); // Handle nested action $response = $this->get('ContainerController/subcontroller/substring/subvieweraction'); $this->assertEquals('Hope this works', $response->getBody()); } public function testSpecificHTTPMethods() { // 'GET /' $response = $this->get('HTTPMethodTestController'); $this->assertEquals('Routed to getRoot', $response->getBody()); // 'POST ' (legacy method of specifying root route) $response = $this->post('HTTPMethodTestController', ['dummy' => 'example']); $this->assertEquals('Routed to postLegacyRoot', $response->getBody()); } }