silverstripe-framework/tests/php/Forms/FormTest.php
2016-11-23 19:25:12 +13:00

806 lines
24 KiB
PHP
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

<?php
namespace SilverStripe\Forms\Tests;
use SilverStripe\Forms\Tests\FormTest\TestController;
use SilverStripe\Forms\Tests\FormTest\ControllerWithSecurityToken;
use SilverStripe\Forms\Tests\FormTest\ControllerWithStrictPostCheck;
use SilverStripe\Forms\Tests\FormTest\Player;
use SilverStripe\Forms\Tests\FormTest\Team;
use SilverStripe\ORM\DataModel;
use SilverStripe\Security\SecurityToken;
use SilverStripe\Security\RandomGenerator;
use SilverStripe\Dev\CSSContentParser;
use SilverStripe\Dev\FunctionalTest;
use SilverStripe\Control\Controller;
use SilverStripe\Control\HTTPRequest;
use SilverStripe\Forms\TextField;
use SilverStripe\Forms\FieldList;
use SilverStripe\Forms\Form;
use SilverStripe\Forms\HeaderField;
use SilverStripe\Forms\TextareaField;
use SilverStripe\Forms\DateField;
use SilverStripe\Forms\NumericField;
use SilverStripe\Forms\LookupField;
use SilverStripe\Forms\FileField;
use SilverStripe\Forms\FormAction;
use SilverStripe\View\SSViewer;
/**
* @skipUpgrade
*/
class FormTest extends FunctionalTest {
protected static $fixture_file = 'FormTest.yml';
protected $extraDataObjects = array(
Player::class,
Team::class,
);
protected $extraControllers = [
TestController::class,
ControllerWithSecurityToken::class,
ControllerWithStrictPostCheck::class,
];
public function setUp() {
parent::setUp();
// Suppress themes
SSViewer::set_themes([
SSViewer::DEFAULT_THEME
]);
}
public function testLoadDataFromRequest() {
$form = new Form(
new Controller(),
'Form',
new FieldList(
new TextField('key1'),
new TextField('namespace[key2]'),
new TextField('namespace[key3][key4]'),
new TextField('othernamespace[key5][key6][key7]')
),
new FieldList()
);
// url would be ?key1=val1&namespace[key2]=val2&namespace[key3][key4]=val4&othernamespace[key5][key6][key7]=val7
$requestData = array(
'key1' => 'val1',
'namespace' => array(
'key2' => 'val2',
'key3' => array(
'key4' => 'val4',
)
),
'othernamespace' => array(
'key5' => array(
'key6' =>array(
'key7' => 'val7'
)
)
)
);
$form->loadDataFrom($requestData);
$fields = $form->Fields();
$this->assertEquals($fields->fieldByName('key1')->Value(), 'val1');
$this->assertEquals($fields->fieldByName('namespace[key2]')->Value(), 'val2');
$this->assertEquals($fields->fieldByName('namespace[key3][key4]')->Value(), 'val4');
$this->assertEquals($fields->fieldByName('othernamespace[key5][key6][key7]')->Value(), 'val7');
}
public function testLoadDataFromUnchangedHandling() {
$form = new Form(
new Controller(),
'Form',
new FieldList(
new TextField('key1'),
new TextField('key2')
),
new FieldList()
);
$form->loadDataFrom(array(
'key1' => 'save',
'key2' => 'dontsave',
'key2_unchanged' => '1'
));
$this->assertEquals(
$form->getData(),
array(
'key1' => 'save',
'key2' => null,
),
'loadDataFrom() doesnt save a field if a matching "<fieldname>_unchanged" flag is set'
);
}
public function testLoadDataFromObject() {
$form = new Form(
new Controller(),
'Form',
new FieldList(
new HeaderField('MyPlayerHeader','My Player'),
new TextField('Name'), // appears in both Player and Team
new TextareaField('Biography'),
new DateField('Birthday'),
new NumericField('BirthdayYear') // dynamic property
),
new FieldList()
);
$captainWithDetails = $this->objFromFixture(Player::class, 'captainWithDetails');
$form->loadDataFrom($captainWithDetails);
$this->assertEquals(
$form->getData(),
array(
'Name' => 'Captain Details',
'Biography' => 'Bio 1',
'Birthday' => '1982-01-01',
'BirthdayYear' => '1982',
),
'LoadDataFrom() loads simple fields and dynamic getters'
);
$captainNoDetails = $this->objFromFixture(Player::class, 'captainNoDetails');
$form->loadDataFrom($captainNoDetails);
$this->assertEquals(
$form->getData(),
array(
'Name' => 'Captain No Details',
'Biography' => null,
'Birthday' => null,
'BirthdayYear' => 0,
),
'LoadNonBlankDataFrom() loads only fields with values, and doesnt overwrite existing values'
);
}
public function testLoadDataFromClearMissingFields() {
$form = new Form(
new Controller(),
'Form',
new FieldList(
new HeaderField('MyPlayerHeader','My Player'),
new TextField('Name'), // appears in both Player and Team
new TextareaField('Biography'),
new DateField('Birthday'),
new NumericField('BirthdayYear'), // dynamic property
$unrelatedField = new TextField('UnrelatedFormField')
//new CheckboxSetField('Teams') // relation editing
),
new FieldList()
);
$unrelatedField->setValue("random value");
$captainWithDetails = $this->objFromFixture(Player::class, 'captainWithDetails');
$form->loadDataFrom($captainWithDetails);
$this->assertEquals(
$form->getData(),
array(
'Name' => 'Captain Details',
'Biography' => 'Bio 1',
'Birthday' => '1982-01-01',
'BirthdayYear' => '1982',
'UnrelatedFormField' => 'random value',
),
'LoadDataFrom() doesnt overwrite fields not found in the object'
);
$captainWithDetails = $this->objFromFixture(Player::class, 'captainNoDetails');
$team2 = $this->objFromFixture(Team::class, 'team2');
$form->loadDataFrom($captainWithDetails);
$form->loadDataFrom($team2, Form::MERGE_CLEAR_MISSING);
$this->assertEquals(
$form->getData(),
array(
'Name' => 'Team 2',
'Biography' => '',
'Birthday' => '',
'BirthdayYear' => 0,
'UnrelatedFormField' => null,
),
'LoadDataFrom() overwrites fields not found in the object with $clearMissingFields=true'
);
}
public function testLookupFieldDisabledSaving() {
$object = new Team();
$form = new Form(
new Controller(),
'Form',
new FieldList(
new LookupField('Players', 'Players')
),
new FieldList()
);
$form->loadDataFrom(array(
'Players' => array(
14,
18,
22
),
));
$form->saveInto($object);
$playersIds = $object->Players()->getIDList();
$this->assertTrue($form->validate());
$this->assertEquals(
$playersIds,
array(),
'saveInto() should not save into the DataObject for the LookupField'
);
}
public function testLoadDataFromIgnoreFalseish() {
$form = new Form(
new Controller(),
'Form',
new FieldList(
new TextField('Biography', 'Biography', 'Custom Default')
),
new FieldList()
);
$captainNoDetails = $this->objFromFixture(Player::class, 'captainNoDetails');
$captainWithDetails = $this->objFromFixture(Player::class, 'captainWithDetails');
$form->loadDataFrom($captainNoDetails, Form::MERGE_IGNORE_FALSEISH);
$this->assertEquals(
$form->getData(),
array('Biography' => 'Custom Default'),
'LoadDataFrom() doesn\'t overwrite fields when MERGE_IGNORE_FALSEISH set and values are false-ish'
);
$form->loadDataFrom($captainWithDetails, Form::MERGE_IGNORE_FALSEISH);
$this->assertEquals(
$form->getData(),
array('Biography' => 'Bio 1'),
'LoadDataFrom() does overwrite fields when MERGE_IGNORE_FALSEISH set and values arent false-ish'
);
}
public function testFormMethodOverride() {
$form = $this->getStubForm();
$form->setFormMethod('GET');
$this->assertNull($form->Fields()->dataFieldByName('_method'));
$form = $this->getStubForm();
$form->setFormMethod('PUT');
$this->assertEquals($form->Fields()->dataFieldByName('_method')->Value(), 'PUT',
'PUT override in forms has PUT in hiddenfield'
);
$this->assertEquals($form->FormMethod(), 'POST',
'PUT override in forms has POST in <form> tag'
);
$form = $this->getStubForm();
$form->setFormMethod('DELETE');
$this->assertEquals($form->Fields()->dataFieldByName('_method')->Value(), 'DELETE',
'PUT override in forms has PUT in hiddenfield'
);
$this->assertEquals($form->FormMethod(), 'POST',
'PUT override in forms has POST in <form> tag'
);
}
public function testValidationExemptActions() {
$this->get('FormTest_Controller');
$this->submitForm(
'Form_Form',
'action_doSubmit',
array(
'Email' => 'test@test.com'
)
);
// Firstly, assert that required fields still work when not using an exempt action
$this->assertPartialMatchBySelector(
'#Form_Form_SomeRequiredField_Holder .required',
array('"Some Required Field" is required'),
'Required fields show a notification on field when left blank'
);
// Re-submit the form using validation-exempt button
$this->submitForm(
'Form_Form',
'action_doSubmitValidationExempt',
array(
'Email' => 'test@test.com'
)
);
// The required message should be empty if validation was skipped
$items = $this->cssParser()->getBySelector('#Form_Form_SomeRequiredField_Holder .required');
$this->assertEmpty($items);
// And the session message should show up is submitted successfully
$this->assertPartialMatchBySelector(
'#Form_Form_error',
array(
'Validation skipped'
),
'Form->sessionMessage() shows up after reloading the form'
);
// Test this same behaviour, but with a form-action exempted via instance
$this->submitForm(
'Form_Form',
'action_doSubmitActionExempt',
array(
'Email' => 'test@test.com'
)
);
// The required message should be empty if validation was skipped
$items = $this->cssParser()->getBySelector('#Form_Form_SomeRequiredField_Holder .required');
$this->assertEmpty($items);
// And the session message should show up is submitted successfully
$this->assertPartialMatchBySelector(
'#Form_Form_error',
array(
'Validation bypassed!'
),
'Form->sessionMessage() shows up after reloading the form'
);
}
public function testSessionValidationMessage() {
$this->get('FormTest_Controller');
$response = $this->post(
'FormTest_Controller/Form',
array(
'Email' => 'invalid',
'Number' => '<a href="http://mysite.com">link</a>' // XSS attempt
// leaving out "Required" field
)
);
$this->assertPartialMatchBySelector(
'#Form_Form_Email_Holder span.message',
array(
'Please enter an email address'
),
'Formfield validation shows note on field if invalid'
);
$this->assertPartialMatchBySelector(
'#Form_Form_SomeRequiredField_Holder span.required',
array(
'"Some Required Field" is required'
),
'Required fields show a notification on field when left blank'
);
$this->assertContains(
'&#039;&lt;a href=&quot;http://mysite.com&quot;&gt;link&lt;/a&gt;&#039; is not a number, only numbers can be accepted for this field',
$response->getBody(),
"Validation messages are safely XML encoded"
);
$this->assertNotContains(
'<a href="http://mysite.com">link</a>',
$response->getBody(),
"Unsafe content is not emitted directly inside the response body"
);
}
public function testSessionSuccessMessage() {
$this->get('FormTest_Controller');
$response = $this->post(
'FormTest_Controller/Form',
array(
'Email' => 'test@test.com',
'SomeRequiredField' => 'test',
)
);
$this->assertPartialMatchBySelector(
'#Form_Form_error',
array(
'Test save was successful'
),
'Form->sessionMessage() shows up after reloading the form'
);
}
public function testGloballyDisabledSecurityTokenInheritsToNewForm() {
SecurityToken::enable();
$form1 = $this->getStubForm();
$this->assertInstanceOf('SilverStripe\\Security\\SecurityToken', $form1->getSecurityToken());
SecurityToken::disable();
$form2 = $this->getStubForm();
$this->assertInstanceOf('SilverStripe\\Security\\NullSecurityToken', $form2->getSecurityToken());
SecurityToken::enable();
}
public function testDisableSecurityTokenDoesntAddTokenFormField() {
SecurityToken::enable();
$formWithToken = $this->getStubForm();
$this->assertInstanceOf(
'SilverStripe\\Forms\\HiddenField',
$formWithToken->Fields()->fieldByName(SecurityToken::get_default_name()),
'Token field added by default'
);
$formWithoutToken = $this->getStubForm();
$formWithoutToken->disableSecurityToken();
$this->assertNull(
$formWithoutToken->Fields()->fieldByName(SecurityToken::get_default_name()),
'Token field not added if disableSecurityToken() is set'
);
}
public function testDisableSecurityTokenAcceptsSubmissionWithoutToken() {
SecurityToken::enable();
$expectedToken = SecurityToken::inst()->getValue();
$response = $this->get('FormTest_ControllerWithSecurityToken');
// can't use submitForm() as it'll automatically insert SecurityID into the POST data
$response = $this->post(
'FormTest_ControllerWithSecurityToken/Form',
array(
'Email' => 'test@test.com',
'action_doSubmit' => 1
// leaving out security token
)
);
$this->assertEquals(400, $response->getStatusCode(), 'Submission fails without security token');
// Generate a new token which doesn't match the current one
$generator = new RandomGenerator();
$invalidToken = $generator->randomToken('sha1');
$this->assertNotEquals($invalidToken, $expectedToken);
// Test token with request
$response = $this->get('FormTest_ControllerWithSecurityToken');
$response = $this->post(
'FormTest_ControllerWithSecurityToken/Form',
array(
'Email' => 'test@test.com',
'action_doSubmit' => 1,
'SecurityID' => $invalidToken
)
);
$this->assertEquals(200, $response->getStatusCode(), 'Submission reloads form if security token invalid');
$this->assertTrue(
stripos($response->getBody(), 'name="SecurityID" value="'.$expectedToken.'"') !== false,
'Submission reloads with correct security token after failure'
);
$this->assertTrue(
stripos($response->getBody(), 'name="SecurityID" value="'.$invalidToken.'"') === false,
'Submission reloads without incorrect security token after failure'
);
$matched = $this->cssParser()->getBySelector('#Form_Form_Email');
$attrs = $matched[0]->attributes();
$this->assertEquals('test@test.com', (string)$attrs['value'], 'Submitted data is preserved');
$response = $this->get('FormTest_ControllerWithSecurityToken');
$tokenEls = $this->cssParser()->getBySelector('#Form_Form_SecurityID');
$this->assertEquals(
1,
count($tokenEls),
'Token form field added for controller without disableSecurityToken()'
);
$token = (string)$tokenEls[0];
$response = $this->submitForm(
'Form_Form',
null,
array(
'Email' => 'test@test.com',
'SecurityID' => $token
)
);
$this->assertEquals(200, $response->getStatusCode(), 'Submission suceeds with security token');
}
public function testStrictFormMethodChecking() {
$response = $this->get('FormTest_ControllerWithStrictPostCheck');
$response = $this->get(
'FormTest_ControllerWithStrictPostCheck/Form/?Email=test@test.com&action_doSubmit=1'
);
$this->assertEquals(405, $response->getStatusCode(), 'Submission fails with wrong method');
$response = $this->get('FormTest_ControllerWithStrictPostCheck');
$response = $this->post(
'FormTest_ControllerWithStrictPostCheck/Form',
array(
'Email' => 'test@test.com',
'action_doSubmit' => 1
)
);
$this->assertEquals(200, $response->getStatusCode(), 'Submission succeeds with correct method');
}
public function testEnableSecurityToken() {
SecurityToken::disable();
$form = $this->getStubForm();
$this->assertFalse($form->getSecurityToken()->isEnabled());
$form->enableSecurityToken();
$this->assertTrue($form->getSecurityToken()->isEnabled());
SecurityToken::disable(); // restore original
}
public function testDisableSecurityToken() {
SecurityToken::enable();
$form = $this->getStubForm();
$this->assertTrue($form->getSecurityToken()->isEnabled());
$form->disableSecurityToken();
$this->assertFalse($form->getSecurityToken()->isEnabled());
SecurityToken::disable(); // restore original
}
public function testEncType() {
$form = $this->getStubForm();
$this->assertEquals('application/x-www-form-urlencoded', $form->getEncType());
$form->setEncType(Form::ENC_TYPE_MULTIPART);
$this->assertEquals('multipart/form-data', $form->getEncType());
$form = $this->getStubForm();
$form->Fields()->push(new FileField(null));
$this->assertEquals('multipart/form-data', $form->getEncType());
$form->setEncType(Form::ENC_TYPE_URLENCODED);
$this->assertEquals('application/x-www-form-urlencoded', $form->getEncType());
}
public function testAddExtraClass() {
$form = $this->getStubForm();
$form->addExtraClass('class1');
$form->addExtraClass('class2');
$this->assertStringEndsWith('class1 class2', $form->extraClass());
}
public function testRemoveExtraClass() {
$form = $this->getStubForm();
$form->addExtraClass('class1');
$form->addExtraClass('class2');
$this->assertStringEndsWith('class1 class2', $form->extraClass());
$form->removeExtraClass('class1');
$this->assertStringEndsWith('class2', $form->extraClass());
}
public function testAddManyExtraClasses() {
$form = $this->getStubForm();
//test we can split by a range of spaces and tabs
$form->addExtraClass('class1 class2 class3 class4 class5');
$this->assertStringEndsWith(
'class1 class2 class3 class4 class5',
$form->extraClass()
);
//test that duplicate classes don't get added
$form->addExtraClass('class1 class2');
$this->assertStringEndsWith(
'class1 class2 class3 class4 class5',
$form->extraClass()
);
}
public function testRemoveManyExtraClasses() {
$form = $this->getStubForm();
$form->addExtraClass('class1 class2 class3 class4 class5');
//test we can remove a single class we just added
$form->removeExtraClass('class3');
$this->assertStringEndsWith(
'class1 class2 class4 class5',
$form->extraClass()
);
//check we can remove many classes at once
$form->removeExtraClass('class1 class5');
$this->assertStringEndsWith(
'class2 class4',
$form->extraClass()
);
//check that removing a dud class is fine
$form->removeExtraClass('dudClass');
$this->assertStringEndsWith(
'class2 class4',
$form->extraClass()
);
}
public function testDefaultClasses() {
Form::config()->update('default_classes', array(
'class1',
));
$form = $this->getStubForm();
$this->assertContains('class1', $form->extraClass(), 'Class list does not contain expected class');
Form::config()->update('default_classes', array(
'class1',
'class2',
));
$form = $this->getStubForm();
$this->assertContains('class1 class2', $form->extraClass(), 'Class list does not contain expected class');
Form::config()->update('default_classes', array(
'class3',
));
$form = $this->getStubForm();
$this->assertContains('class3', $form->extraClass(), 'Class list does not contain expected class');
$form->removeExtraClass('class3');
$this->assertNotContains('class3', $form->extraClass(), 'Class list contains unexpected class');
}
public function testAttributes() {
$form = $this->getStubForm();
$form->setAttribute('foo', 'bar');
$this->assertEquals('bar', $form->getAttribute('foo'));
$attrs = $form->getAttributes();
$this->assertArrayHasKey('foo', $attrs);
$this->assertEquals('bar', $attrs['foo']);
}
public function testButtonClicked() {
$form = $this->getStubForm();
$action = $form->buttonClicked();
$this->assertNull($action);
$controller = new FormTest\TestController();
$form = $controller->Form();
$request = new HTTPRequest('POST', 'FormTest_Controller/Form', array(), array(
'Email' => 'test@test.com',
'SomeRequiredField' => 1,
'action_doSubmit' => 1
));
$form->httpSubmission($request);
$button = $form->buttonClicked();
$this->assertInstanceOf('SilverStripe\\Forms\\FormAction', $button);
$this->assertEquals('doSubmit', $button->actionName());
/** @skipUpgrade */
$form = new Form(
$controller,
'Form',
new FieldList(new FormAction('doSubmit', 'Inline action')),
new FieldList()
);
$form->disableSecurityToken();
$request = new HTTPRequest('POST', 'FormTest_Controller/Form', array(), array(
'action_doSubmit' => 1
));
$form->httpSubmission($request);
$button = $form->buttonClicked();
$this->assertInstanceOf('SilverStripe\\Forms\\FormAction', $button);
$this->assertEquals('doSubmit', $button->actionName());
}
public function testCheckAccessAction() {
$controller = new FormTest\TestController();
$form = new Form(
$controller,
'Form',
new FieldList(),
new FieldList(new FormAction('actionName', 'Action'))
);
$this->assertTrue($form->checkAccessAction('actionName'));
$form = new Form(
$controller,
'Form',
new FieldList(new FormAction('inlineAction', 'Inline action')),
new FieldList()
);
$this->assertTrue($form->checkAccessAction('inlineAction'));
}
public function testAttributesHTML() {
$form = $this->getStubForm();
$form->setAttribute('foo', 'bar');
$this->assertContains('foo="bar"', $form->getAttributesHTML());
$form->setAttribute('foo', null);
$this->assertNotContains('foo="bar"', $form->getAttributesHTML());
$form->setAttribute('foo', true);
$this->assertContains('foo="foo"', $form->getAttributesHTML());
$form->setAttribute('one', 1);
$form->setAttribute('two', 2);
$form->setAttribute('three', 3);
$this->assertNotContains('one="1"', $form->getAttributesHTML('one', 'two'));
$this->assertNotContains('two="2"', $form->getAttributesHTML('one', 'two'));
$this->assertContains('three="3"', $form->getAttributesHTML('one', 'two'));
}
function testMessageEscapeHtml() {
$form = $this->getStubForm();
$form->getController()->handleRequest(new HTTPRequest('GET', '/'), DataModel::inst()); // stub out request
$form->sessionMessage('<em>Escaped HTML</em>', 'good', true);
$parser = new CSSContentParser($form->forTemplate());
$messageEls = $parser->getBySelector('.message');
$this->assertContains(
'&lt;em&gt;Escaped HTML&lt;/em&gt;',
$messageEls[0]->asXML()
);
$form = $this->getStubForm();
$form->getController()->handleRequest(new HTTPRequest('GET', '/'), DataModel::inst()); // stub out request
$form->sessionMessage('<em>Unescaped HTML</em>', 'good', false);
$parser = new CSSContentParser($form->forTemplate());
$messageEls = $parser->getBySelector('.message');
$this->assertContains(
'<em>Unescaped HTML</em>',
$messageEls[0]->asXML()
);
}
function testFieldMessageEscapeHtml() {
$form = $this->getStubForm();
$form->getController()->handleRequest(new HTTPRequest('GET', '/'), DataModel::inst()); // stub out request
$form->addErrorMessage('key1', '<em>Escaped HTML</em>', 'good', true);
$form->setupFormErrors();
$parser = new CSSContentParser($result = $form->forTemplate());
$messageEls = $parser->getBySelector('#Form_Form_key1_Holder .message');
$this->assertContains(
'&lt;em&gt;Escaped HTML&lt;/em&gt;',
$messageEls[0]->asXML()
);
$form = $this->getStubForm();
$form->getController()->handleRequest(new HTTPRequest('GET', '/'), DataModel::inst()); // stub out request
$form->addErrorMessage('key1', '<em>Unescaped HTML</em>', 'good', false);
$form->setupFormErrors();
$parser = new CSSContentParser($form->forTemplate());
$messageEls = $parser->getBySelector('#Form_Form_key1_Holder .message');
$this->assertContains(
'<em>Unescaped HTML</em>',
$messageEls[0]->asXML()
);
}
public function testGetExtraFields()
{
$form = new FormTest\ExtraFieldsForm(
new FormTest\TestController(),
'Form',
new FieldList(new TextField('key1')),
new FieldList()
);
$data = array(
'key1' => 'test',
'ExtraFieldCheckbox' => false,
);
$form->loadDataFrom($data);
$formData = $form->getData();
$this->assertEmpty($formData['ExtraFieldCheckbox']);
}
protected function getStubForm() {
return new Form(
new FormTest\TestController(),
'Form',
new FieldList(new TextField('key1')),
new FieldList()
);
}
}