|
|
|
|
@ -34,7 +34,6 @@ use OC\AppFramework\Middleware\Security\SecurityMiddleware;
|
|
|
|
|
use OC\AppFramework\Utility\ControllerMethodReflector;
|
|
|
|
|
use OC\Settings\AuthorizedGroupMapper;
|
|
|
|
|
use OCP\App\IAppManager;
|
|
|
|
|
use OCP\AppFramework\Controller;
|
|
|
|
|
use OCP\AppFramework\Http\JSONResponse;
|
|
|
|
|
use OCP\AppFramework\Http\RedirectResponse;
|
|
|
|
|
use OCP\AppFramework\Http\TemplateResponse;
|
|
|
|
|
@ -46,11 +45,14 @@ use OCP\IRequestId;
|
|
|
|
|
use OCP\IURLGenerator;
|
|
|
|
|
use OCP\IUserSession;
|
|
|
|
|
use Psr\Log\LoggerInterface;
|
|
|
|
|
use Test\AppFramework\Middleware\Security\Mock\NormalController;
|
|
|
|
|
use Test\AppFramework\Middleware\Security\Mock\OCSController;
|
|
|
|
|
use Test\AppFramework\Middleware\Security\Mock\SecurityMiddlewareController;
|
|
|
|
|
|
|
|
|
|
class SecurityMiddlewareTest extends \Test\TestCase {
|
|
|
|
|
/** @var SecurityMiddleware|\PHPUnit\Framework\MockObject\MockObject */
|
|
|
|
|
private $middleware;
|
|
|
|
|
/** @var Controller|\PHPUnit\Framework\MockObject\MockObject */
|
|
|
|
|
/** @var SecurityMiddlewareController */
|
|
|
|
|
private $controller;
|
|
|
|
|
/** @var SecurityException */
|
|
|
|
|
private $secException;
|
|
|
|
|
@ -80,12 +82,15 @@ class SecurityMiddlewareTest extends \Test\TestCase {
|
|
|
|
|
|
|
|
|
|
$this->authorizedGroupMapper = $this->createMock(AuthorizedGroupMapper::class);
|
|
|
|
|
$this->userSession = $this->createMock(IUserSession::class);
|
|
|
|
|
$this->controller = $this->createMock(Controller::class);
|
|
|
|
|
$this->request = $this->createMock(IRequest::class);
|
|
|
|
|
$this->controller = new SecurityMiddlewareController(
|
|
|
|
|
'test',
|
|
|
|
|
$this->request
|
|
|
|
|
);
|
|
|
|
|
$this->reader = new ControllerMethodReflector();
|
|
|
|
|
$this->logger = $this->createMock(LoggerInterface::class);
|
|
|
|
|
$this->navigationManager = $this->createMock(INavigationManager::class);
|
|
|
|
|
$this->urlGenerator = $this->createMock(IURLGenerator::class);
|
|
|
|
|
$this->request = $this->createMock(IRequest::class);
|
|
|
|
|
$this->l10n = $this->createMock(IL10N::class);
|
|
|
|
|
$this->middleware = $this->getMiddleware(true, true, false);
|
|
|
|
|
$this->secException = new SecurityException('hey', false);
|
|
|
|
|
@ -115,18 +120,78 @@ class SecurityMiddlewareTest extends \Test\TestCase {
|
|
|
|
|
);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function dataNoCSRFRequiredPublicPage(): array {
|
|
|
|
|
return [
|
|
|
|
|
['testAnnotationNoCSRFRequiredPublicPage'],
|
|
|
|
|
['testAnnotationNoCSRFRequiredAttributePublicPage'],
|
|
|
|
|
['testAnnotationPublicPageAttributeNoCSRFRequired'],
|
|
|
|
|
['testAttributeNoCSRFRequiredPublicPage'],
|
|
|
|
|
];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function dataPublicPage(): array {
|
|
|
|
|
return [
|
|
|
|
|
['testAnnotationPublicPage'],
|
|
|
|
|
['testAttributePublicPage'],
|
|
|
|
|
];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function dataNoCSRFRequired(): array {
|
|
|
|
|
return [
|
|
|
|
|
['testAnnotationNoCSRFRequired'],
|
|
|
|
|
['testAttributeNoCSRFRequired'],
|
|
|
|
|
];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function dataPublicPageStrictCookieRequired(): array {
|
|
|
|
|
return [
|
|
|
|
|
['testAnnotationPublicPageStrictCookieRequired'],
|
|
|
|
|
['testAnnotationStrictCookieRequiredAttributePublicPage'],
|
|
|
|
|
['testAnnotationPublicPageAttributeStrictCookiesRequired'],
|
|
|
|
|
['testAttributePublicPageStrictCookiesRequired'],
|
|
|
|
|
];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function dataNoCSRFRequiredPublicPageStrictCookieRequired(): array {
|
|
|
|
|
return [
|
|
|
|
|
['testAnnotationNoCSRFRequiredPublicPageStrictCookieRequired'],
|
|
|
|
|
['testAttributeNoCSRFRequiredPublicPageStrictCookiesRequired'],
|
|
|
|
|
];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function dataNoAdminRequiredNoCSRFRequired(): array {
|
|
|
|
|
return [
|
|
|
|
|
['testAnnotationNoAdminRequiredNoCSRFRequired'],
|
|
|
|
|
['testAttributeNoAdminRequiredNoCSRFRequired'],
|
|
|
|
|
];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function dataNoAdminRequiredNoCSRFRequiredPublicPage(): array {
|
|
|
|
|
return [
|
|
|
|
|
['testAnnotationNoAdminRequiredNoCSRFRequiredPublicPage'],
|
|
|
|
|
['testAttributeNoAdminRequiredNoCSRFRequiredPublicPage'],
|
|
|
|
|
];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function dataNoCSRFRequiredSubAdminRequired(): array {
|
|
|
|
|
return [
|
|
|
|
|
['testAnnotationNoCSRFRequiredSubAdminRequired'],
|
|
|
|
|
['testAnnotationNoCSRFRequiredAttributeSubAdminRequired'],
|
|
|
|
|
['testAnnotationSubAdminRequiredAttributeNoCSRFRequired'],
|
|
|
|
|
['testAttributeNoCSRFRequiredSubAdminRequired'],
|
|
|
|
|
];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @PublicPage
|
|
|
|
|
* @NoCSRFRequired
|
|
|
|
|
* @dataProvider dataNoCSRFRequiredPublicPage
|
|
|
|
|
*/
|
|
|
|
|
public function testSetNavigationEntry() {
|
|
|
|
|
public function testSetNavigationEntry(string $method): void {
|
|
|
|
|
$this->navigationManager->expects($this->once())
|
|
|
|
|
->method('setActiveEntry')
|
|
|
|
|
->with($this->equalTo('files'));
|
|
|
|
|
|
|
|
|
|
$this->reader->reflect(__CLASS__, __FUNCTION__);
|
|
|
|
|
$this->middleware->beforeController($this->controller, __FUNCTION__);
|
|
|
|
|
$this->reader->reflect($this->controller, $method);
|
|
|
|
|
$this->middleware->beforeController($this->controller, $method);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@ -146,7 +211,7 @@ class SecurityMiddlewareTest extends \Test\TestCase {
|
|
|
|
|
$sec = $this->getMiddleware($isLoggedIn, $isAdminUser, false);
|
|
|
|
|
|
|
|
|
|
try {
|
|
|
|
|
$this->reader->reflect(__CLASS__, $method);
|
|
|
|
|
$this->reader->reflect($this->controller, $method);
|
|
|
|
|
$sec->beforeController($this->controller, $method);
|
|
|
|
|
} catch (SecurityException $ex) {
|
|
|
|
|
$this->assertEquals($status, $ex->getCode());
|
|
|
|
|
@ -159,75 +224,71 @@ class SecurityMiddlewareTest extends \Test\TestCase {
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function testAjaxStatusLoggedInCheck() {
|
|
|
|
|
public function testAjaxStatusLoggedInCheck(): void {
|
|
|
|
|
$this->ajaxExceptionStatus(
|
|
|
|
|
__FUNCTION__,
|
|
|
|
|
'testNoAnnotationNorAttribute',
|
|
|
|
|
'isLoggedIn',
|
|
|
|
|
Http::STATUS_UNAUTHORIZED
|
|
|
|
|
);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @NoCSRFRequired
|
|
|
|
|
* @dataProvider dataNoCSRFRequired
|
|
|
|
|
*/
|
|
|
|
|
public function testAjaxNotAdminCheck() {
|
|
|
|
|
public function testAjaxNotAdminCheck(string $method): void {
|
|
|
|
|
$this->ajaxExceptionStatus(
|
|
|
|
|
__FUNCTION__,
|
|
|
|
|
$method,
|
|
|
|
|
'isAdminUser',
|
|
|
|
|
Http::STATUS_FORBIDDEN
|
|
|
|
|
);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @PublicPage
|
|
|
|
|
* @dataProvider dataPublicPage
|
|
|
|
|
*/
|
|
|
|
|
public function testAjaxStatusCSRFCheck() {
|
|
|
|
|
public function testAjaxStatusCSRFCheck(string $method): void {
|
|
|
|
|
$this->ajaxExceptionStatus(
|
|
|
|
|
__FUNCTION__,
|
|
|
|
|
$method,
|
|
|
|
|
'passesCSRFCheck',
|
|
|
|
|
Http::STATUS_PRECONDITION_FAILED
|
|
|
|
|
);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @PublicPage
|
|
|
|
|
* @NoCSRFRequired
|
|
|
|
|
* @dataProvider dataNoCSRFRequiredPublicPage
|
|
|
|
|
*/
|
|
|
|
|
public function testAjaxStatusAllGood() {
|
|
|
|
|
public function testAjaxStatusAllGood(string $method): void {
|
|
|
|
|
$this->ajaxExceptionStatus(
|
|
|
|
|
__FUNCTION__,
|
|
|
|
|
$method,
|
|
|
|
|
'isLoggedIn',
|
|
|
|
|
0
|
|
|
|
|
);
|
|
|
|
|
$this->ajaxExceptionStatus(
|
|
|
|
|
__FUNCTION__,
|
|
|
|
|
$method,
|
|
|
|
|
'isAdminUser',
|
|
|
|
|
0
|
|
|
|
|
);
|
|
|
|
|
$this->ajaxExceptionStatus(
|
|
|
|
|
__FUNCTION__,
|
|
|
|
|
$method,
|
|
|
|
|
'passesCSRFCheck',
|
|
|
|
|
0
|
|
|
|
|
);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @PublicPage
|
|
|
|
|
* @NoCSRFRequired
|
|
|
|
|
* @dataProvider dataNoCSRFRequiredPublicPage
|
|
|
|
|
*/
|
|
|
|
|
public function testNoChecks() {
|
|
|
|
|
public function testNoChecks(string $method): void {
|
|
|
|
|
$this->request->expects($this->never())
|
|
|
|
|
->method('passesCSRFCheck')
|
|
|
|
|
->willReturn(false);
|
|
|
|
|
|
|
|
|
|
$sec = $this->getMiddleware(false, false, false);
|
|
|
|
|
|
|
|
|
|
$this->reader->reflect(__CLASS__, __FUNCTION__);
|
|
|
|
|
$sec->beforeController($this->controller, __FUNCTION__);
|
|
|
|
|
$this->reader->reflect($this->controller, $method);
|
|
|
|
|
$sec->beforeController($this->controller, $method);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @param string $method
|
|
|
|
|
* @param string $expects
|
|
|
|
|
@ -250,15 +311,15 @@ class SecurityMiddlewareTest extends \Test\TestCase {
|
|
|
|
|
$this->addToAssertionCount(1);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
$this->reader->reflect(__CLASS__, $method);
|
|
|
|
|
$this->reader->reflect($this->controller, $method);
|
|
|
|
|
$sec->beforeController($this->controller, $method);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @PublicPage
|
|
|
|
|
* @dataProvider dataPublicPage
|
|
|
|
|
*/
|
|
|
|
|
public function testCsrfCheck() {
|
|
|
|
|
public function testCsrfCheck(string $method): void {
|
|
|
|
|
$this->expectException(\OC\AppFramework\Middleware\Security\Exceptions\CrossSiteRequestForgeryException::class);
|
|
|
|
|
|
|
|
|
|
$this->request->expects($this->once())
|
|
|
|
|
@ -267,28 +328,26 @@ class SecurityMiddlewareTest extends \Test\TestCase {
|
|
|
|
|
$this->request->expects($this->once())
|
|
|
|
|
->method('passesStrictCookieCheck')
|
|
|
|
|
->willReturn(true);
|
|
|
|
|
$this->reader->reflect(__CLASS__, __FUNCTION__);
|
|
|
|
|
$this->middleware->beforeController($this->controller, __FUNCTION__);
|
|
|
|
|
$this->reader->reflect($this->controller, $method);
|
|
|
|
|
$this->middleware->beforeController($this->controller, $method);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @PublicPage
|
|
|
|
|
* @NoCSRFRequired
|
|
|
|
|
* @dataProvider dataNoCSRFRequiredPublicPage
|
|
|
|
|
*/
|
|
|
|
|
public function testNoCsrfCheck() {
|
|
|
|
|
public function testNoCsrfCheck(string $method) {
|
|
|
|
|
$this->request->expects($this->never())
|
|
|
|
|
->method('passesCSRFCheck')
|
|
|
|
|
->willReturn(false);
|
|
|
|
|
|
|
|
|
|
$this->reader->reflect(__CLASS__, __FUNCTION__);
|
|
|
|
|
$this->middleware->beforeController($this->controller, __FUNCTION__);
|
|
|
|
|
$this->reader->reflect($this->controller, $method);
|
|
|
|
|
$this->middleware->beforeController($this->controller, $method);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @PublicPage
|
|
|
|
|
* @dataProvider dataPublicPage
|
|
|
|
|
*/
|
|
|
|
|
public function testPassesCsrfCheck() {
|
|
|
|
|
public function testPassesCsrfCheck(string $method): void {
|
|
|
|
|
$this->request->expects($this->once())
|
|
|
|
|
->method('passesCSRFCheck')
|
|
|
|
|
->willReturn(true);
|
|
|
|
|
@ -296,14 +355,14 @@ class SecurityMiddlewareTest extends \Test\TestCase {
|
|
|
|
|
->method('passesStrictCookieCheck')
|
|
|
|
|
->willReturn(true);
|
|
|
|
|
|
|
|
|
|
$this->reader->reflect(__CLASS__, __FUNCTION__);
|
|
|
|
|
$this->middleware->beforeController($this->controller, __FUNCTION__);
|
|
|
|
|
$this->reader->reflect($this->controller, $method);
|
|
|
|
|
$this->middleware->beforeController($this->controller, $method);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @PublicPage
|
|
|
|
|
* @dataProvider dataPublicPage
|
|
|
|
|
*/
|
|
|
|
|
public function testFailCsrfCheck() {
|
|
|
|
|
public function testFailCsrfCheck(string $method): void {
|
|
|
|
|
$this->expectException(\OC\AppFramework\Middleware\Security\Exceptions\CrossSiteRequestForgeryException::class);
|
|
|
|
|
|
|
|
|
|
$this->request->expects($this->once())
|
|
|
|
|
@ -313,16 +372,15 @@ class SecurityMiddlewareTest extends \Test\TestCase {
|
|
|
|
|
->method('passesStrictCookieCheck')
|
|
|
|
|
->willReturn(true);
|
|
|
|
|
|
|
|
|
|
$this->reader->reflect(__CLASS__, __FUNCTION__);
|
|
|
|
|
$this->middleware->beforeController($this->controller, __FUNCTION__);
|
|
|
|
|
$this->reader->reflect($this->controller, $method);
|
|
|
|
|
$this->middleware->beforeController($this->controller, $method);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @PublicPage
|
|
|
|
|
* @StrictCookieRequired
|
|
|
|
|
* @dataProvider dataPublicPageStrictCookieRequired
|
|
|
|
|
*/
|
|
|
|
|
public function testStrictCookieRequiredCheck() {
|
|
|
|
|
$this->expectException(\OC\Appframework\Middleware\Security\Exceptions\StrictCookieMissingException::class);
|
|
|
|
|
public function testStrictCookieRequiredCheck(string $method): void {
|
|
|
|
|
$this->expectException(\OC\AppFramework\Middleware\Security\Exceptions\StrictCookieMissingException::class);
|
|
|
|
|
|
|
|
|
|
$this->request->expects($this->never())
|
|
|
|
|
->method('passesCSRFCheck');
|
|
|
|
|
@ -330,68 +388,57 @@ class SecurityMiddlewareTest extends \Test\TestCase {
|
|
|
|
|
->method('passesStrictCookieCheck')
|
|
|
|
|
->willReturn(false);
|
|
|
|
|
|
|
|
|
|
$this->reader->reflect(__CLASS__, __FUNCTION__);
|
|
|
|
|
$this->middleware->beforeController($this->controller, __FUNCTION__);
|
|
|
|
|
$this->reader->reflect($this->controller, $method);
|
|
|
|
|
$this->middleware->beforeController($this->controller, $method);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @PublicPage
|
|
|
|
|
* @NoCSRFRequired
|
|
|
|
|
* @dataProvider dataNoCSRFRequiredPublicPage
|
|
|
|
|
*/
|
|
|
|
|
public function testNoStrictCookieRequiredCheck() {
|
|
|
|
|
public function testNoStrictCookieRequiredCheck(string $method): void {
|
|
|
|
|
$this->request->expects($this->never())
|
|
|
|
|
->method('passesStrictCookieCheck')
|
|
|
|
|
->willReturn(false);
|
|
|
|
|
|
|
|
|
|
$this->reader->reflect(__CLASS__, __FUNCTION__);
|
|
|
|
|
$this->middleware->beforeController($this->controller, __FUNCTION__);
|
|
|
|
|
$this->reader->reflect($this->controller, $method);
|
|
|
|
|
$this->middleware->beforeController($this->controller, $method);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @PublicPage
|
|
|
|
|
* @NoCSRFRequired
|
|
|
|
|
* @StrictCookieRequired
|
|
|
|
|
* @dataProvider dataNoCSRFRequiredPublicPageStrictCookieRequired
|
|
|
|
|
*/
|
|
|
|
|
public function testPassesStrictCookieRequiredCheck() {
|
|
|
|
|
public function testPassesStrictCookieRequiredCheck(string $method): void {
|
|
|
|
|
$this->request
|
|
|
|
|
->expects($this->once())
|
|
|
|
|
->method('passesStrictCookieCheck')
|
|
|
|
|
->willReturn(true);
|
|
|
|
|
|
|
|
|
|
$this->reader->reflect(__CLASS__, __FUNCTION__);
|
|
|
|
|
$this->middleware->beforeController($this->controller, __FUNCTION__);
|
|
|
|
|
$this->reader->reflect($this->controller, $method);
|
|
|
|
|
$this->middleware->beforeController($this->controller, $method);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function dataCsrfOcsController() {
|
|
|
|
|
$controller = $this->getMockBuilder('OCP\AppFramework\Controller')
|
|
|
|
|
->disableOriginalConstructor()
|
|
|
|
|
->getMock();
|
|
|
|
|
$ocsController = $this->getMockBuilder('OCP\AppFramework\OCSController')
|
|
|
|
|
->disableOriginalConstructor()
|
|
|
|
|
->getMock();
|
|
|
|
|
|
|
|
|
|
public function dataCsrfOcsController(): array {
|
|
|
|
|
return [
|
|
|
|
|
[$controller, false, false, true],
|
|
|
|
|
[$controller, false, true, true],
|
|
|
|
|
[$controller, true, false, true],
|
|
|
|
|
[$controller, true, true, true],
|
|
|
|
|
|
|
|
|
|
[$ocsController, false, false, true],
|
|
|
|
|
[$ocsController, false, true, false],
|
|
|
|
|
[$ocsController, true, false, false],
|
|
|
|
|
[$ocsController, true, true, false],
|
|
|
|
|
[NormalController::class, false, false, true],
|
|
|
|
|
[NormalController::class, false, true, true],
|
|
|
|
|
[NormalController::class, true, false, true],
|
|
|
|
|
[NormalController::class, true, true, true],
|
|
|
|
|
|
|
|
|
|
[OCSController::class, false, false, true],
|
|
|
|
|
[OCSController::class, false, true, false],
|
|
|
|
|
[OCSController::class, true, false, false],
|
|
|
|
|
[OCSController::class, true, true, false],
|
|
|
|
|
];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @dataProvider dataCsrfOcsController
|
|
|
|
|
* @param Controller $controller
|
|
|
|
|
* @param string $controllerClass
|
|
|
|
|
* @param bool $hasOcsApiHeader
|
|
|
|
|
* @param bool $hasBearerAuth
|
|
|
|
|
* @param bool $exception
|
|
|
|
|
*/
|
|
|
|
|
public function testCsrfOcsController(Controller $controller, bool $hasOcsApiHeader, bool $hasBearerAuth, bool $exception) {
|
|
|
|
|
public function testCsrfOcsController(string $controllerClass, bool $hasOcsApiHeader, bool $hasBearerAuth, bool $exception): void {
|
|
|
|
|
$this->request
|
|
|
|
|
->method('getHeader')
|
|
|
|
|
->willReturnCallback(function ($header) use ($hasOcsApiHeader, $hasBearerAuth) {
|
|
|
|
|
@ -407,6 +454,8 @@ class SecurityMiddlewareTest extends \Test\TestCase {
|
|
|
|
|
->method('passesStrictCookieCheck')
|
|
|
|
|
->willReturn(true);
|
|
|
|
|
|
|
|
|
|
$controller = new $controllerClass('test', $this->request);
|
|
|
|
|
|
|
|
|
|
try {
|
|
|
|
|
$this->middleware->beforeController($controller, 'foo');
|
|
|
|
|
$this->assertFalse($exception);
|
|
|
|
|
@ -416,71 +465,117 @@ class SecurityMiddlewareTest extends \Test\TestCase {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @NoCSRFRequired
|
|
|
|
|
* @NoAdminRequired
|
|
|
|
|
* @dataProvider dataNoAdminRequiredNoCSRFRequired
|
|
|
|
|
*/
|
|
|
|
|
public function testLoggedInCheck() {
|
|
|
|
|
$this->securityCheck(__FUNCTION__, 'isLoggedIn');
|
|
|
|
|
public function testLoggedInCheck(string $method): void {
|
|
|
|
|
$this->securityCheck($method, 'isLoggedIn');
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @NoCSRFRequired
|
|
|
|
|
* @NoAdminRequired
|
|
|
|
|
* @dataProvider dataNoAdminRequiredNoCSRFRequired
|
|
|
|
|
*/
|
|
|
|
|
public function testFailLoggedInCheck() {
|
|
|
|
|
$this->securityCheck(__FUNCTION__, 'isLoggedIn', true);
|
|
|
|
|
public function testFailLoggedInCheck(string $method): void {
|
|
|
|
|
$this->securityCheck($method, 'isLoggedIn', true);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @NoCSRFRequired
|
|
|
|
|
* @dataProvider dataNoCSRFRequired
|
|
|
|
|
*/
|
|
|
|
|
public function testIsAdminCheck() {
|
|
|
|
|
$this->securityCheck(__FUNCTION__, 'isAdminUser');
|
|
|
|
|
public function testIsAdminCheck(string $method): void {
|
|
|
|
|
$this->securityCheck($method, 'isAdminUser');
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @NoCSRFRequired
|
|
|
|
|
* @SubAdminRequired
|
|
|
|
|
* @dataProvider dataNoCSRFRequiredSubAdminRequired
|
|
|
|
|
*/
|
|
|
|
|
public function testIsNotSubAdminCheck() {
|
|
|
|
|
$this->reader->reflect(__CLASS__, __FUNCTION__);
|
|
|
|
|
public function testIsNotSubAdminCheck(string $method): void {
|
|
|
|
|
$this->reader->reflect($this->controller, $method);
|
|
|
|
|
$sec = $this->getMiddleware(true, false, false);
|
|
|
|
|
|
|
|
|
|
$this->expectException(SecurityException::class);
|
|
|
|
|
$sec->beforeController($this, __METHOD__);
|
|
|
|
|
$sec->beforeController($this->controller, $method);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @NoCSRFRequired
|
|
|
|
|
* @SubAdminRequired
|
|
|
|
|
* @dataProvider dataNoCSRFRequiredSubAdminRequired
|
|
|
|
|
*/
|
|
|
|
|
public function testIsSubAdminCheck() {
|
|
|
|
|
$this->reader->reflect(__CLASS__, __FUNCTION__);
|
|
|
|
|
public function testIsSubAdminCheck(string $method): void {
|
|
|
|
|
$this->reader->reflect($this->controller, $method);
|
|
|
|
|
$sec = $this->getMiddleware(true, false, true);
|
|
|
|
|
|
|
|
|
|
$sec->beforeController($this, __METHOD__);
|
|
|
|
|
$sec->beforeController($this->controller, $method);
|
|
|
|
|
$this->addToAssertionCount(1);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @NoCSRFRequired
|
|
|
|
|
* @SubAdminRequired
|
|
|
|
|
* @dataProvider dataNoCSRFRequiredSubAdminRequired
|
|
|
|
|
*/
|
|
|
|
|
public function testIsSubAdminAndAdminCheck() {
|
|
|
|
|
$this->reader->reflect(__CLASS__, __FUNCTION__);
|
|
|
|
|
public function testIsSubAdminAndAdminCheck(string $method): void {
|
|
|
|
|
$this->reader->reflect($this->controller, $method);
|
|
|
|
|
$sec = $this->getMiddleware(true, true, true);
|
|
|
|
|
|
|
|
|
|
$sec->beforeController($this, __METHOD__);
|
|
|
|
|
$sec->beforeController($this->controller, $method);
|
|
|
|
|
$this->addToAssertionCount(1);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @NoCSRFRequired
|
|
|
|
|
* @dataProvider dataNoCSRFRequired
|
|
|
|
|
*/
|
|
|
|
|
public function testFailIsAdminCheck() {
|
|
|
|
|
$this->securityCheck(__FUNCTION__, 'isAdminUser', true);
|
|
|
|
|
public function testFailIsAdminCheck(string $method): void {
|
|
|
|
|
$this->securityCheck($method, 'isAdminUser', true);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @dataProvider dataNoAdminRequiredNoCSRFRequiredPublicPage
|
|
|
|
|
*/
|
|
|
|
|
public function testRestrictedAppLoggedInPublicPage(string $method): void {
|
|
|
|
|
$middleware = $this->getMiddleware(true, false, false);
|
|
|
|
|
$this->reader->reflect($this->controller, $method);
|
|
|
|
|
|
|
|
|
|
$this->appManager->method('getAppPath')
|
|
|
|
|
->with('files')
|
|
|
|
|
->willReturn('foo');
|
|
|
|
|
|
|
|
|
|
$this->appManager->method('isEnabledForUser')
|
|
|
|
|
->with('files')
|
|
|
|
|
->willReturn(false);
|
|
|
|
|
|
|
|
|
|
$middleware->beforeController($this->controller, $method);
|
|
|
|
|
$this->addToAssertionCount(1);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @dataProvider dataNoAdminRequiredNoCSRFRequiredPublicPage
|
|
|
|
|
*/
|
|
|
|
|
public function testRestrictedAppNotLoggedInPublicPage(string $method): void {
|
|
|
|
|
$middleware = $this->getMiddleware(false, false, false);
|
|
|
|
|
$this->reader->reflect($this->controller, $method);
|
|
|
|
|
|
|
|
|
|
$this->appManager->method('getAppPath')
|
|
|
|
|
->with('files')
|
|
|
|
|
->willReturn('foo');
|
|
|
|
|
|
|
|
|
|
$this->appManager->method('isEnabledForUser')
|
|
|
|
|
->with('files')
|
|
|
|
|
->willReturn(false);
|
|
|
|
|
|
|
|
|
|
$middleware->beforeController($this->controller, $method);
|
|
|
|
|
$this->addToAssertionCount(1);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @dataProvider dataNoAdminRequiredNoCSRFRequired
|
|
|
|
|
*/
|
|
|
|
|
public function testRestrictedAppLoggedIn(string $method): void {
|
|
|
|
|
$middleware = $this->getMiddleware(true, false, false, false);
|
|
|
|
|
$this->reader->reflect($this->controller, $method);
|
|
|
|
|
|
|
|
|
|
$this->appManager->method('getAppPath')
|
|
|
|
|
->with('files')
|
|
|
|
|
->willReturn('foo');
|
|
|
|
|
|
|
|
|
|
$this->expectException(AppNotEnabledException::class);
|
|
|
|
|
$middleware->beforeController($this->controller, $method);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@ -602,75 +697,4 @@ class SecurityMiddlewareTest extends \Test\TestCase {
|
|
|
|
|
|
|
|
|
|
$this->assertTrue($response instanceof JSONResponse);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function dataRestrictedApp() {
|
|
|
|
|
return [
|
|
|
|
|
[false, false, false,],
|
|
|
|
|
[false, false, true,],
|
|
|
|
|
[false, true, false,],
|
|
|
|
|
[false, true, true,],
|
|
|
|
|
[ true, false, false,],
|
|
|
|
|
[ true, false, true,],
|
|
|
|
|
[ true, true, false,],
|
|
|
|
|
[ true, true, true,],
|
|
|
|
|
];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @PublicPage
|
|
|
|
|
* @NoAdminRequired
|
|
|
|
|
* @NoCSRFRequired
|
|
|
|
|
*/
|
|
|
|
|
public function testRestrictedAppLoggedInPublicPage() {
|
|
|
|
|
$middleware = $this->getMiddleware(true, false, false);
|
|
|
|
|
$this->reader->reflect(__CLASS__, __FUNCTION__);
|
|
|
|
|
|
|
|
|
|
$this->appManager->method('getAppPath')
|
|
|
|
|
->with('files')
|
|
|
|
|
->willReturn('foo');
|
|
|
|
|
|
|
|
|
|
$this->appManager->method('isEnabledForUser')
|
|
|
|
|
->with('files')
|
|
|
|
|
->willReturn(false);
|
|
|
|
|
|
|
|
|
|
$middleware->beforeController($this->controller, __FUNCTION__);
|
|
|
|
|
$this->addToAssertionCount(1);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @PublicPage
|
|
|
|
|
* @NoAdminRequired
|
|
|
|
|
* @NoCSRFRequired
|
|
|
|
|
*/
|
|
|
|
|
public function testRestrictedAppNotLoggedInPublicPage() {
|
|
|
|
|
$middleware = $this->getMiddleware(false, false, false);
|
|
|
|
|
$this->reader->reflect(__CLASS__, __FUNCTION__);
|
|
|
|
|
|
|
|
|
|
$this->appManager->method('getAppPath')
|
|
|
|
|
->with('files')
|
|
|
|
|
->willReturn('foo');
|
|
|
|
|
|
|
|
|
|
$this->appManager->method('isEnabledForUser')
|
|
|
|
|
->with('files')
|
|
|
|
|
->willReturn(false);
|
|
|
|
|
|
|
|
|
|
$middleware->beforeController($this->controller, __FUNCTION__);
|
|
|
|
|
$this->addToAssertionCount(1);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @NoAdminRequired
|
|
|
|
|
* @NoCSRFRequired
|
|
|
|
|
*/
|
|
|
|
|
public function testRestrictedAppLoggedIn() {
|
|
|
|
|
$middleware = $this->getMiddleware(true, false, false, false);
|
|
|
|
|
$this->reader->reflect(__CLASS__, __FUNCTION__);
|
|
|
|
|
|
|
|
|
|
$this->appManager->method('getAppPath')
|
|
|
|
|
->with('files')
|
|
|
|
|
->willReturn('foo');
|
|
|
|
|
|
|
|
|
|
$this->expectException(AppNotEnabledException::class);
|
|
|
|
|
$middleware->beforeController($this->controller, __FUNCTION__);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
Joas Schilling
GitHub