Club Drupal

<?php

/**

 * @file

 * Tests for user.module.

 */

class UserRegistrationTestCase extends DrupalWebTestCase {

  public static function getInfo() {

    return array(

      'name' => 'User registration',

      'description' => 'Test registration of user under different configurations.',

      'group' => 'User'

    );

  }

  function setUp() {

    parent::setUp('field_test');

  }

  function testRegistrationWithEmailVerification() {

    // Require e-mail verification.

    variable_set('user_email_verification', TRUE);

    // Set registration to administrator only.

    variable_set('user_register', USER_REGISTER_ADMINISTRATORS_ONLY);

    $this->drupalGet('user/register');

    $this->assertResponse(403, 'Registration page is inaccessible when only administrators can create accounts.');

    // Allow registration by site visitors without administrator approval.

    variable_set('user_register', USER_REGISTER_VISITORS);

    $edit = array();

    $edit['name'] = $name = $this->randomName();

    $edit['mail'] = $mail = $edit['name'] . '@example.com';

    $this->drupalPost('user/register', $edit, t('Create new account'));

    $this->assertText(t('A welcome message with further instructions has been sent to your e-mail address.'), 'User registered successfully.');

    $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

    $new_user = reset($accounts);

    $this->assertTrue($new_user->status, 'New account is active after registration.');

    // Allow registration by site visitors, but require administrator approval.

    variable_set('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL);

    $edit = array();

    $edit['name'] = $name = $this->randomName();

    $edit['mail'] = $mail = $edit['name'] . '@example.com';

    $this->drupalPost('user/register', $edit, t('Create new account'));

    $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

    $new_user = reset($accounts);

    $this->assertFalse($new_user->status, 'New account is blocked until approved by an administrator.');

  }

  function testRegistrationWithoutEmailVerification() {

    // Don't require e-mail verification.

    variable_set('user_email_verification', FALSE);

    // Allow registration by site visitors without administrator approval.

    variable_set('user_register', USER_REGISTER_VISITORS);

    $edit = array();

    $edit['name'] = $name = $this->randomName();

    $edit['mail'] = $mail = $edit['name'] . '@example.com';

    // Try entering a mismatching password.

    $edit['pass[pass1]'] = '99999.0';

    $edit['pass[pass2]'] = '99999';

    $this->drupalPost('user/register', $edit, t('Create new account'));

    $this->assertText(t('The specified passwords do not match.'), 'Typing mismatched passwords displays an error message.');

    // Enter a correct password.

    $edit['pass[pass1]'] = $new_pass = $this->randomName();

    $edit['pass[pass2]'] = $new_pass;

    $this->drupalPost('user/register', $edit, t('Create new account'));

    $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

    $new_user = reset($accounts);

    $this->assertText(t('Registration successful. You are now logged in.'), 'Users are logged in after registering.');

    $this->drupalLogout();

    // Allow registration by site visitors, but require administrator approval.

    variable_set('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL);

    $edit = array();

    $edit['name'] = $name = $this->randomName();

    $edit['mail'] = $mail = $edit['name'] . '@example.com';

    $edit['pass[pass1]'] = $pass = $this->randomName();

    $edit['pass[pass2]'] = $pass;

    $this->drupalPost('user/register', $edit, t('Create new account'));

    $this->assertText(t('Thank you for applying for an account. Your account is currently pending approval by the site administrator.'), 'Users are notified of pending approval');

    // Try to login before administrator approval.

    $auth = array(

      'name' => $name,

      'pass' => $pass,

    );

    $this->drupalPost('user/login', $auth, t('Log in'));

    $this->assertText(t('The username @name has not been activated or is blocked.', array('@name' => $name)), 'User cannot login yet.');

    // Activate the new account.

    $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

    $new_user = reset($accounts);

    $admin_user = $this->drupalCreateUser(array('administer users'));

    $this->drupalLogin($admin_user);

    $edit = array(

      'status' => 1,

    );

    $this->drupalPost('user/' . $new_user->uid . '/edit', $edit, t('Save'));

    $this->drupalLogout();

    // Login after administrator approval.

    $this->drupalPost('user/login', $auth, t('Log in'));

    $this->assertText(t('Member for'), 'User can log in after administrator approval.');

  }

  function testRegistrationEmailDuplicates() {

    // Don't require e-mail verification.

    variable_set('user_email_verification', FALSE);

    // Allow registration by site visitors without administrator approval.

    variable_set('user_register', USER_REGISTER_VISITORS);

    // Set up a user to check for duplicates.

    $duplicate_user = $this->drupalCreateUser();

    $edit = array();

    $edit['name'] = $this->randomName();

    $edit['mail'] = $duplicate_user->mail;

    // Attempt to create a new account using an existing e-mail address.

    $this->drupalPost('user/register', $edit, t('Create new account'));

    $this->assertText(t('The e-mail address @email is already registered.', array('@email' => $duplicate_user->mail)), 'Supplying an exact duplicate email address displays an error message');

    // Attempt to bypass duplicate email registration validation by adding spaces.

    $edit['mail'] = '   ' . $duplicate_user->mail . '   ';

    $this->drupalPost('user/register', $edit, t('Create new account'));

    $this->assertText(t('The e-mail address @email is already registered.', array('@email' => $duplicate_user->mail)), 'Supplying a duplicate email address with added whitespace displays an error message');

  }

  function testRegistrationDefaultValues() {

    // Allow registration by site visitors without administrator approval.

    variable_set('user_register', USER_REGISTER_VISITORS);

    // Don't require e-mail verification.

    variable_set('user_email_verification', FALSE);

    // Set the default timezone to Brussels.

    variable_set('configurable_timezones', 1);

    variable_set('date_default_timezone', 'Europe/Brussels');

    // Check that the account information fieldset's options are not displayed

    // is a fieldset if there is not more than one fieldset in the form.

    $this->drupalGet('user/register');

    $this->assertNoRaw('<fieldset id="edit-account"><legend>Account information</legend>', 'Account settings fieldset was hidden.');

    $edit = array();

    $edit['name'] = $name = $this->randomName();

    $edit['mail'] = $mail = $edit['name'] . '@example.com';

    $edit['pass[pass1]'] = $new_pass = $this->randomName();

    $edit['pass[pass2]'] = $new_pass;

    $this->drupalPost(NULL, $edit, t('Create new account'));

    // Check user fields.

    $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

    $new_user = reset($accounts);

    $this->assertEqual($new_user->name, $name, 'Username matches.');

    $this->assertEqual($new_user->mail, $mail, 'E-mail address matches.');

    $this->assertEqual($new_user->theme, '', 'Correct theme field.');

    $this->assertEqual($new_user->signature, '', 'Correct signature field.');

    $this->assertTrue(($new_user->created > REQUEST_TIME - 20 ), 'Correct creation time.');

    $this->assertEqual($new_user->status, variable_get('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL) == USER_REGISTER_VISITORS ? 1 : 0, 'Correct status field.');

    $this->assertEqual($new_user->timezone, variable_get('date_default_timezone'), 'Correct time zone field.');

    $this->assertEqual($new_user->language, '', 'Correct language field.');

    $this->assertEqual($new_user->picture, '', 'Correct picture field.');

    $this->assertEqual($new_user->init, $mail, 'Correct init field.');

  }

  /**

   * Tests Field API fields on user registration forms.

   */

  function testRegistrationWithUserFields() {

    // Create a field, and an instance on 'user' entity type.

    $field = array(

      'type' => 'test_field',

      'field_name' => 'test_user_field',

      'cardinality' => 1,

    );

    field_create_field($field);

    $instance = array(

      'field_name' => 'test_user_field',

      'entity_type' => 'user',

      'label' => 'Some user field',

      'bundle' => 'user',

      'required' => TRUE,

      'settings' => array('user_register_form' => FALSE),

    );

    field_create_instance($instance);

    // Check that the field does not appear on the registration form.

    $this->drupalGet('user/register');

    $this->assertNoText($instance['label'], 'The field does not appear on user registration form');

    // Have the field appear on the registration form.

    $instance['settings']['user_register_form'] = TRUE;

    field_update_instance($instance);

    $this->drupalGet('user/register');

    $this->assertText($instance['label'], 'The field appears on user registration form');

    // Check that validation errors are correctly reported.

    $edit = array();

    $edit['name'] = $name = $this->randomName();

    $edit['mail'] = $mail = $edit['name'] . '@example.com';

    // Missing input in required field.

    $edit['test_user_field[und][0][value]'] = '';

    $this->drupalPost(NULL, $edit, t('Create new account'));

    $this->assertRaw(t('@name field is required.', array('@name' => $instance['label'])), 'Field validation error was correctly reported.');

    // Invalid input.

    $edit['test_user_field[und][0][value]'] = '-1';

    $this->drupalPost(NULL, $edit, t('Create new account'));

    $this->assertRaw(t('%name does not accept the value -1.', array('%name' => $instance['label'])), 'Field validation error was correctly reported.');

    // Submit with valid data.

    $value = rand(1, 255);

    $edit['test_user_field[und][0][value]'] = $value;

    $this->drupalPost(NULL, $edit, t('Create new account'));

    // Check user fields.

    $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

    $new_user = reset($accounts);

    $this->assertEqual($new_user->test_user_field[LANGUAGE_NONE][0]['value'], $value, 'The field value was correctly saved.');

    // Check that the 'add more' button works.

    $field['cardinality'] = FIELD_CARDINALITY_UNLIMITED;

    field_update_field($field);

    foreach (array('js', 'nojs') as $js) {

      $this->drupalGet('user/register');

      // Add two inputs.

      $value = rand(1, 255);

      $edit = array();

      $edit['test_user_field[und][0][value]'] = $value;

      if ($js == 'js') {

        $this->drupalPostAJAX(NULL, $edit, 'test_user_field_add_more');

        $this->drupalPostAJAX(NULL, $edit, 'test_user_field_add_more');

      }

      else {

        $this->drupalPost(NULL, $edit, t('Add another item'));

        $this->drupalPost(NULL, $edit, t('Add another item'));

      }

      // Submit with three values.

      $edit['test_user_field[und][1][value]'] = $value + 1;

      $edit['test_user_field[und][2][value]'] = $value + 2;

      $edit['name'] = $name = $this->randomName();

      $edit['mail'] = $mail = $edit['name'] . '@example.com';

      $this->drupalPost(NULL, $edit, t('Create new account'));

      // Check user fields.

      $accounts = user_load_multiple(array(), array('name' => $name, 'mail' => $mail));

      $new_user = reset($accounts);

      $this->assertEqual($new_user->test_user_field[LANGUAGE_NONE][0]['value'], $value, format_string('@js : The field value was correclty saved.', array('@js' => $js)));

      $this->assertEqual($new_user->test_user_field[LANGUAGE_NONE][1]['value'], $value + 1, format_string('@js : The field value was correclty saved.', array('@js' => $js)));

      $this->assertEqual($new_user->test_user_field[LANGUAGE_NONE][2]['value'], $value + 2, format_string('@js : The field value was correclty saved.', array('@js' => $js)));

    }

  }

}

class UserValidationTestCase extends DrupalWebTestCase {

  public static function getInfo() {

    return array(

      'name' => 'Username/e-mail validation',

      'description' => 'Verify that username/email validity checks behave as designed.',

      'group' => 'User'

    );

  }

  // Username validation.

  function testUsernames() {

    $test_cases = array( // '<username>' => array('<description>', 'assert<testName>'),

      'foo'                    => array('Valid username', 'assertNull'),

      'FOO'                    => array('Valid username', 'assertNull'),

      'Foo O\'Bar'             => array('Valid username', 'assertNull'),

      'foo@bar'                => array('Valid username', 'assertNull'),

      'foo@example.com'        => array('Valid username', 'assertNull'),

      'foo@-example.com'       => array('Valid username', 'assertNull'), // invalid domains are allowed in usernames

      'þòøÇߪř€'               => array('Valid username', 'assertNull'),

      'foo+bar'                => array('Valid username', 'assertNull'), // '+' symbol is allowed

      'ᚠᛇᚻ᛫ᛒᛦᚦ'                => array('Valid UTF8 username', 'assertNull'), // runes

      ' foo'                   => array('Invalid username that starts with a space', 'assertNotNull'),

      'foo '                   => array('Invalid username that ends with a space', 'assertNotNull'),

      'foo  bar'               => array('Invalid username that contains 2 spaces \'  \'', 'assertNotNull'),

      ''                       => array('Invalid empty username', 'assertNotNull'),

      'foo/'                   => array('Invalid username containing invalid chars', 'assertNotNull'),

      'foo' . chr(0) . 'bar'   => array('Invalid username containing chr(0)', 'assertNotNull'), // NULL

      'foo' . chr(13) . 'bar'  => array('Invalid username containing chr(13)', 'assertNotNull'), // CR

      str_repeat('x', USERNAME_MAX_LENGTH + 1) => array('Invalid excessively long username', 'assertNotNull'),

    );

    foreach ($test_cases as $name => $test_case) {

      list($description, $test) = $test_case;

      $result = user_validate_name($name);

      $this->$test($result, $description . ' (' . $name . ')');

    }

  }

  // Mail validation. More extensive tests can be found at common.test

  function testMailAddresses() {

    $test_cases = array( // '<username>' => array('<description>', 'assert<testName>'),

      ''                => array('Empty mail address', 'assertNotNull'),

      'foo'             => array('Invalid mail address', 'assertNotNull'),

      'foo@example.com' => array('Valid mail address', 'assertNull'),

    );

    foreach ($test_cases as $name => $test_case) {

      list($description, $test) = $test_case;

      $result = user_validate_mail($name);

      $this->$test($result, $description . ' (' . $name . ')');

    }

  }

}

/**

 * Functional tests for user logins, including rate limiting of login attempts.

 */

class UserLoginTestCase extends DrupalWebTestCase {

  public static function getInfo() {

    return array(

      'name' => 'User login',

      'description' => 'Ensure that login works as expected.',

      'group' => 'User',

    );

  }

  function setUp() {

    parent::setUp('user_session_test', 'user_flood_test');

  }

  /**

   * Test the global login flood control.

   */

  function testGlobalLoginFloodControl() {

    // Set the global login limit.

    variable_set('user_failed_login_ip_limit', 10);

    // Set a high per-user limit out so that it is not relevant in the test.

    variable_set('user_failed_login_user_limit', 4000);

    $user1 = $this->drupalCreateUser(array());

    $incorrect_user1 = clone $user1;

    $incorrect_user1->pass_raw .= 'incorrect';

    // Try 2 failed logins.

    for ($i = 0; $i < 2; $i++) {

      $this->assertFailedLogin($incorrect_user1);

    }

    // A successful login will not reset the IP-based flood control count.

    $this->drupalLogin($user1);

    $this->drupalLogout();

    // Try 8 more failed logins, they should not trigger the flood control

    // mechanism.

    for ($i = 0; $i < 8; $i++) {

      $this->assertFailedLogin($incorrect_user1);

    }

    // The next login trial should result in an IP-based flood error message.

    $this->assertFailedLogin($incorrect_user1, 'ip');

    // A login with the correct password should also result in a flood error

    // message.

    $this->assertFailedLogin($user1, 'ip');

  }

  /**

   * Test the per-user login flood control.

   */

  function testPerUserLoginFloodControl() {

    // Set a high global limit out so that it is not relevant in the test.

    variable_set('user_failed_login_ip_limit', 4000);

    // Set the per-user login limit.

    variable_set('user_failed_login_user_limit', 3);

    $user1 = $this->drupalCreateUser(array());

    $incorrect_user1 = clone $user1;

    $incorrect_user1->pass_raw .= 'incorrect';

    $user2 = $this->drupalCreateUser(array());

    // Try 2 failed logins.

    for ($i = 0; $i < 2; $i++) {

      $this->assertFailedLogin($incorrect_user1);

    }

    // A successful login will reset the per-user flood control count.

    $this->drupalLogin($user1);

    $this->drupalLogout();

    // Try 3 failed logins for user 1, they will not trigger flood control.

    for ($i = 0; $i < 3; $i++) {

      $this->assertFailedLogin($incorrect_user1);

    }

    // Try one successful attempt for user 2, it should not trigger any

    // flood control.

    $this->drupalLogin($user2);

    $this->drupalLogout();

    // Try one more attempt for user 1, it should be rejected, even if the

    // correct password has been used.

    $this->assertFailedLogin($user1, 'user');

  }

  /**

   * Test that user password is re-hashed upon login after changing $count_log2.

   */

  function testPasswordRehashOnLogin() {

    // Load password hashing API.

    require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'includes/password.inc');

    // Set initial $count_log2 to the default, DRUPAL_HASH_COUNT.

    variable_set('password_count_log2', DRUPAL_HASH_COUNT);

    // Create a new user and authenticate.

    $account = $this->drupalCreateUser(array());

    $password = $account->pass_raw;

    $this->drupalLogin($account);

    $this->drupalLogout();

    // Load the stored user. The password hash should reflect $count_log2.

    $account = user_load($account->uid);

    $this->assertIdentical(_password_get_count_log2($account->pass), DRUPAL_HASH_COUNT);

    // Change $count_log2 and log in again.

    variable_set('password_count_log2', DRUPAL_HASH_COUNT + 1);

    $account->pass_raw = $password;

    $this->drupalLogin($account);

    // Load the stored user, which should have a different password hash now.

    $account = user_load($account->uid, TRUE);

    $this->assertIdentical(_password_get_count_log2($account->pass), DRUPAL_HASH_COUNT + 1);

  }

  /**

   * Test logging in when an anon session already exists.

   */

  function testLoginWithAnonSession() {

    // Visit the callback to generate a session for this anon user.

    $this->drupalGet('user_session_test_anon_session');

    // Now login.

    $account = $this->drupalCreateUser(array());

    $this->drupalLogin($account);

  }

  /**

   * Make an unsuccessful login attempt.

   *

   * @param $account

   *   A user object with name and pass_raw attributes for the login attempt.

   * @param $flood_trigger

   *   Whether or not to expect that the flood control mechanism will be

   *   triggered.

   */

  function assertFailedLogin($account, $flood_trigger = NULL) {

    $edit = array(

      'name' => $account->name,

      'pass' => $account->pass_raw,

    );

    $this->drupalPost('user', $edit, t('Log in'));

    $this->assertNoFieldByXPath("//input[@name='pass' and @value!='']", NULL, 'Password value attribute is blank.');

    if (isset($flood_trigger)) {

      $this->assertResponse(403);

      $user_log = db_query_range('SELECT message FROM {watchdog} WHERE type = :type ORDER BY wid DESC', 0, 1, array(':type' => 'user'))->fetchField();

      $user_flood_test_log = db_query_range('SELECT message FROM {watchdog} WHERE type = :type ORDER BY wid DESC', 0, 1, array(':type' => 'user_flood_test'))->fetchField();

      if ($flood_trigger == 'user') {

        $this->assertRaw(t('Sorry, there have been more than @count failed login attempts for this account. It is temporarily blocked. Try again later or <a href="@url">request a new password</a>.', array('@url' => url('user/password'), '@count' => variable_get('user_failed_login_user_limit', 5))));

        $this->assertEqual('Flood control blocked login attempt for %user from %ip.', $user_log, 'A watchdog message was logged for the login attempt blocked by flood control per user');

        $this->assertEqual('hook_user_flood_control was passed username %username and IP %ip.', $user_flood_test_log, 'hook_user_flood_control was invoked by flood control per user');

      }

      else {

        // No uid, so the limit is IP-based.

        $this->assertRaw(t('Sorry, too many failed login attempts from your IP address. This IP address is temporarily blocked. Try again later or <a href="@url">request a new password</a>.', array('@url' => url('user/password'))));

        $this->assertEqual('Flood control blocked login attempt from %ip.', $user_log, 'A watchdog message was logged for the login attempt blocked by flood control per IP');

        $this->assertEqual('hook_user_flood_control was passed IP %ip.', $user_flood_test_log, 'hook_user_flood_control was invoked by flood control per IP');

      }

    }

    else {

      $this->assertText(t('Sorry, unrecognized username or password. Have you forgotten your password?'));

    }

  }

}

/**

 * Tests resetting a user password.

 */

class UserPasswordResetTestCase extends DrupalWebTestCase {

  protected $profile = 'standard';

  public static function getInfo() {

    return array(

      'name' => 'Reset password',

      'description' => 'Ensure that password reset methods work as expected.',

      'group' => 'User',

    );

  }

  /**

   * Retrieves password reset email and extracts the login link.

   */

  public function getResetURL() {

    // Assume the most recent email.

    $_emails = $this->drupalGetMails();

    $email = end($_emails);

    $urls = array();

    preg_match('#.+user/reset/.+#', $email['body'], $urls);

    return $urls[0];

  }

  /**

   * Tests password reset functionality.

   */

  function testUserPasswordReset() {

    // Create a user.

    $account = $this->drupalCreateUser();

    $this->drupalLogin($account);

    $this->drupalLogout();

    // Attempt to reset password.

    $edit = array('name' => $account->name);

    $this->drupalPost('user/password', $edit, t('E-mail new password'));

    // Confirm the password reset.

    $this->assertText(t('Further instructions have been sent to your e-mail address.'), 'Password reset instructions mailed message displayed.');

    // Ensure that flood control was not triggered.

    $this->assertNoText(t('is temporarily blocked. Try again later'), 'Flood control was not triggered by single password reset.');

    // Create an image field to enable an Ajax request on the user profile page.

    $field = array(

      'field_name' => 'field_avatar',

      'type' => 'image',

      'settings' => array(),

      'cardinality' => 1,

    );

    field_create_field($field);

    $instance = array(

      'field_name' => $field['field_name'],

      'entity_type' => 'user',

      'label' => 'Avatar',

      'bundle' => 'user',

      'required' => FALSE,

      'settings' => array(),

      'widget' => array(

        'type' => 'image_image',

        'settings' => array(),

      ),

    );

    field_create_instance($instance);

    $resetURL = $this->getResetURL();

    $this->drupalGet($resetURL);

    // Check successful login.

    $this->drupalPost(NULL, NULL, t('Log in'));

    // Make sure the Ajax request from uploading a file does not invalidate the

    // reset token.

    $image = current($this->drupalGetTestFiles('image'));

    $edit = array(

      'files[field_avatar_und_0]' => drupal_realpath($image->uri),

    );

    $this->drupalPostAJAX(NULL, $edit, 'field_avatar_und_0_upload_button');

    // Change the forgotten password.

    $password = user_password();

    $edit = array('pass[pass1]' => $password, 'pass[pass2]' => $password);

    $this->drupalPost(NULL, $edit, t('Save'));

    $this->assertText(t('The changes have been saved.'), 'Forgotten password changed.');

  }

  /**

   * Test user-based flood control on password reset.

   */

  function testPasswordResetFloodControlPerUser() {

    // Set a very low limit for testing.

    variable_set('user_pass_reset_user_limit', 2);

    // Create a user.

    $account = $this->drupalCreateUser();

    $this->drupalLogin($account);

    $this->drupalLogout();

    $edit = array('name' => $account->name);

    // Try 2 requests that should not trigger flood control.

    for ($i = 0; $i < 2; $i++) {

      $this->drupalPost('user/password', $edit, t('E-mail new password'));

      // Confirm the password reset.

      $this->assertText(t('Further instructions have been sent to your e-mail address.'), 'Password reset instructions mailed message displayed.');

      // Ensure that flood control was not triggered.

      $this->assertNoText(t('is temporarily blocked. Try again later'), 'Flood control was not triggered by password reset.');

    }

    // A successful password reset should clear flood events.

    $resetURL = $this->getResetURL();

    $this->drupalGet($resetURL);

    // Check successful login.

    $this->drupalPost(NULL, NULL, t('Log in'));

    $this->drupalLogout();

    // Try 2 requests that should not trigger flood control.

    for ($i = 0; $i < 2; $i++) {

      $this->drupalPost('user/password', $edit, t('E-mail new password'));

      // Confirm the password reset.

      $this->assertText(t('Further instructions have been sent to your e-mail address.'), 'Password reset instructions mailed message displayed.');

      // Ensure that flood control was not triggered.

      $this->assertNoText(t('is temporarily blocked. Try again later'), 'Flood control was not triggered by password reset.');

    }

    // The next request should trigger flood control

    $this->drupalPost('user/password', $edit, t('E-mail new password'));

    // Confirm the password reset was blocked.

    $this->assertNoText(t('Further instructions have been sent to your e-mail address.'), 'Password reset instructions mailed message not displayed for excessive password resets.');

    // Ensure that flood control was triggered.

    $this->assertText(t('Sorry, there have been more than 2 password reset attempts for this account. It is temporarily blocked.'), 'Flood control was triggered by excessive password resets for one user.');

  }

  /**

   * Test IP-based flood control on password reset.

   */

  function testPasswordResetFloodControlPerIp() {

    // Set a very low limit for testing.

    variable_set('user_pass_reset_ip_limit', 2);

    // Try 2 requests that should not trigger flood control.

    for ($i = 0; $i < 2; $i++) {

      $name = $this->randomName();

      $edit = array('name' => $name);

      $this->drupalPost('user/password', $edit, t('E-mail new password'));

      // Confirm the password reset was not blocked. Note that @name is used

      // instead of %name as assertText() works with plain text not HTML.

      $this->assertText(t('Sorry, @name is not recognized as a user name or an e-mail address.', array('@name' => $name)), 'User name not recognized message displayed.');

      // Ensure that flood control was not triggered.

      $this->assertNoText(t('is temporarily blocked. Try again later'), 'Flood control was not triggered by password reset.');

    }

    // The next request should trigger flood control

    $name = $this->randomName();

    $edit = array('name' => $name);

    $this->drupalPost('user/password', $edit, t('E-mail new password'));

    // Confirm the password reset was blocked early. Note that @name is used

    // instead of %name as assertText() works with plain text not HTML.

    $this->assertNoText(t('Sorry, @name is not recognized as a user name or an e-mail address.', array('@name' => $name)), 'User name not recognized message not displayed.');

    // Ensure that flood control was triggered.

    $this->assertText(t('Sorry, too many password reset attempts from your IP address. This IP address is temporarily blocked.'), 'Flood control was triggered by excessive password resets from one IP.');

  }

  /**

   * Test user password reset while logged in.

   */

  function testUserPasswordResetLoggedIn() {

    $account = $this->drupalCreateUser();

    $this->drupalLogin($account);

    // Make sure the test account has a valid password.

    user_save($account, array('pass' => user_password()));

    // Generate one time login link.

    $reset_url = user_pass_reset_url($account);

    $this->drupalGet($reset_url);

    $this->assertText('Reset password');

    $this->drupalPost(NULL, NULL, t('Log in'));

    $this->assertText('You have just used your one-time login link. It is no longer necessary to use this link to log in. Please change your password.');

    $pass = user_password();

    $edit = array(

      'pass[pass1]' => $pass,

      'pass[pass2]' => $pass,

    );

    $this->drupalPost(NULL, $edit, t('Save'));

    $this->assertText('The changes have been saved.');

  }

  /**

   * Attempts login using an expired password reset link.

   */

  function testUserPasswordResetExpired() {

    // Set password reset timeout variable to 43200 seconds = 12 hours.

    $timeout = 43200;

    variable_set('user_password_reset_timeout', $timeout);

    // Create a user.

    $account = $this->drupalCreateUser();

    $this->drupalLogin($account);

    // Load real user object.

    $account = user_load($account->uid, TRUE);

    $this->drupalLogout();

    // To attempt an expired password reset, create a password reset link as if

    // its request time was 60 seconds older than the allowed limit of timeout.

    $bogus_timestamp = REQUEST_TIME - variable_get('user_password_reset_timeout', 86400) - 60;

    $this->drupalGet("user/reset/$account->uid/$bogus_timestamp/" . user_pass_rehash($account->pass, $bogus_timestamp, $account->login, $account->uid));

    $this->assertText(t('You have tried to use a one-time login link that has expired. Please request a new one using the form below.'), 'Expired password reset request rejected.');

  }

  /**

   * Prefill the text box on incorrect login via link to password reset page.

   */

  function testUserPasswordTextboxFilled() {

    $this->drupalGet('user/login');

    $edit = array(

      'name' => $this->randomName(),

      'pass' => $this->randomName(),

    );

    $this->drupalPost('user', $edit, t('Log in'));

    $this->assertRaw(t('Sorry, unrecognized username or password. <a href="@password">Have you forgotten your password?</a>',

      array('@password' => url('user/password', array('query' => array('name' => $edit['name']))))));

    unset($edit['pass']);

    $this->drupalGet('user/password', array('query' => array('name' => $edit['name'])));

    $this->assertFieldByName('name', $edit['name'], 'User name found.');

  }

  /**

   * Make sure that users cannot forge password reset URLs of other users.

   */

  function testResetImpersonation() {

    // Make sure user 1 has a valid password, so it does not interfere with the

    // test user accounts that are created below.

    $account = user_load(1);

    user_save($account, array('pass' => user_password()));

    // Create two identical user accounts except for the user name. They must

    // have the same empty password, so we can't use $this->drupalCreateUser().

    $edit = array();

    $edit['name'] = $this->randomName();

    $edit['mail'] = $edit['name'] . '@example.com';

    $edit['status'] = 1;

    $user1 = user_save(drupal_anonymous_user(), $edit);

    $edit['name'] = $this->randomName();

    $user2 = user_save(drupal_anonymous_user(), $edit);

    // The password reset URL must not be valid for the second user when only

    // the user ID is changed in the URL.

    $reset_url = user_pass_reset_url($user1);

    $attack_reset_url = str_replace("user/reset/$user1->uid", "user/reset/$user2->uid", $reset_url);

    $this->drupalGet($attack_reset_url);

    $this->assertNoText($user2->name, 'The invalid password reset page does not show the user name.');

    $this->assertUrl('user/password', array(), 'The user is redirected to the password reset request page.');

    $this->assertText('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.');

    // When legacy code calls user_pass_rehash() without providing the $uid

    // parameter, neither password reset URL should be valid since it is

    // impossible for the system to determine which user account the token was

    // intended for.

    $timestamp = REQUEST_TIME;

    // Pass an explicit NULL for the $uid parameter of user_pass_rehash()

    // rather than not passing it at all, to avoid triggering PHP warnings in

    // the test.

    $reset_url_token = user_pass_rehash($user1->pass, $timestamp, $user1->login, NULL);

    $reset_url = url("user/reset/$user1->uid/$timestamp/$reset_url_token", array('absolute' => TRUE));

    $this->drupalGet($reset_url);

    $this->assertNoText($user1->name, 'The invalid password reset page does not show the user name.');

    $this->assertUrl('user/password', array(), 'The user is redirected to the password reset request page.');

    $this->assertText('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.');

    $attack_reset_url = str_replace("user/reset/$user1->uid", "user/reset/$user2->uid", $reset_url);

    $this->drupalGet($attack_reset_url);

    $this->assertNoText($user2->name, 'The invalid password reset page does not show the user name.');

    $this->assertUrl('user/password', array(), 'The user is redirected to the password reset request page.');

    $this->assertText('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.');

    // To verify that user_pass_rehash() never returns a valid result in the

    // above situation (even if legacy code also called it to attempt to

    // validate the token, rather than just to generate the URL), check that a

    // second call with the same parameters produces a different result.

    $new_reset_url_token = user_pass_rehash($user1->pass, $timestamp, $user1->login, NULL);

    $this->assertNotEqual($reset_url_token, $new_reset_url_token);

    // However, when the duplicate account is removed, the password reset URL

    // should be valid.

    user_delete($user2->uid);

    $reset_url_token = user_pass_rehash($user1->pass, $timestamp, $user1->login, NULL);

    $reset_url = url("user/reset/$user1->uid/$timestamp/$reset_url_token", array('absolute' => TRUE));

    $this->drupalGet($reset_url);

    $this->assertText($user1->name, 'The valid password reset page shows the user name.');

    $this->assertUrl($reset_url, array(), 'The user remains on the password reset login page.');

    $this->assertNoText('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.');

  }

}

/**

 * Test cancelling a user.

 */

class UserCancelTestCase extends DrupalWebTestCase {

  public static function getInfo() {

    return array(

      'name' => 'Cancel account',

      'description' => 'Ensure that account cancellation methods work as expected.',

      'group' => 'User',

    );

  }

  function setUp() {

    parent::setUp('comment');

  }

  /**

   * Attempt to cancel account without permission.

   */

  function testUserCancelWithoutPermission() {

    variable_set('user_cancel_method', 'user_cancel_reassign');

    // Create a user.

    $account = $this->drupalCreateUser(array());

    $this->drupalLogin($account);

    // Load real user object.

    $account = user_load($account->uid, TRUE);

    // Create a node.

    $node = $this->drupalCreateNode(array('uid' => $account->uid));

    // Attempt to cancel account.

    $this->drupalGet('user/' . $account->uid . '/edit');

    $this->assertNoRaw(t('Cancel account'), 'No cancel account button displayed.');

    // Attempt bogus account cancellation request confirmation.

    $timestamp = $account->login;

    $this->drupalGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid));

    $this->assertResponse(403, 'Bogus cancelling request rejected.');

    $account = user_load($account->uid);

    $this->assertTrue($account->status == 1, 'User account was not canceled.');

    // Confirm user's content has not been altered.

    $test_node = node_load($node->nid, NULL, TRUE);

    $this->assertTrue(($test_node->uid == $account->uid && $test_node->status == 1), 'Node of the user has not been altered.');

  }

  /**

   * Tests that user account for uid 1 cannot be cancelled.

   *

   * This should never be possible, or the site owner would become unable to

   * administer the site.

   */

  function testUserCancelUid1() {

    // Update uid 1's name and password to we know it.

    $password = user_password();

    require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'includes/password.inc');

    $account = array(

      'name' => 'user1',

      'pass' => user_hash_password(trim($password)),

    );

    // We cannot use user_save() here or the password would be hashed again.

    db_update('users')

      ->fields($account)

      ->condition('uid', 1)

      ->execute();

    // Reload and log in uid 1.

    $user1 = user_load(1, TRUE);

    $user1->pass_raw = $password;

    // Try to cancel uid 1's account with a different user.

    $this->admin_user = $this->drupalCreateUser(array('administer users'));

    $this->drupalLogin($this->admin_user);

    $edit = array(

      'operation' => 'cancel',

      'accounts[1]' => TRUE,

    );

    $this->drupalPost('admin/people', $edit, t('Update'));

    // Verify that uid 1's account was not cancelled.

    $user1 = user_load(1, TRUE);

    $this->assertEqual($user1->status, 1, 'User #1 still exists and is not blocked.');

  }

  /**

   * Attempt invalid account cancellations.

   */

  function testUserCancelInvalid() {

    variable_set('user_cancel_method', 'user_cancel_reassign');

    // Create a user.

    $account = $this->drupalCreateUser(array('cancel account'));

    $this->drupalLogin($account);

    // Load real user object.

    $account = user_load($account->uid, TRUE);

    // Create a node.

    $node = $this->drupalCreateNode(array('uid' => $account->uid));

    // Attempt to cancel account.

    $this->drupalPost('user/' . $account->uid . '/edit', NULL, t('Cancel account'));

    // Confirm account cancellation.

    $timestamp = time();

    $this->drupalPost(NULL, NULL, t('Cancel account'));

    $this->assertText(t('A confirmation request to cancel your account has been sent to your e-mail address.'), 'Account cancellation request mailed message displayed.');

    // Attempt bogus account cancellation request confirmation.

    $bogus_timestamp = $timestamp + 60;

    $this->drupalGet("user/$account->uid/cancel/confirm/$bogus_timestamp/" . user_pass_rehash($account->pass, $bogus_timestamp, $account->login, $account->uid));

    $this->assertText(t('You have tried to use an account cancellation link that has expired. Please request a new one using the form below.'), 'Bogus cancelling request rejected.');

    $account = user_load($account->uid);

    $this->assertTrue($account->status == 1, 'User account was not canceled.');

    // Attempt expired account cancellation request confirmation.

    $bogus_timestamp = $timestamp - 86400 - 60;

    $this->drupalGet("user/$account->uid/cancel/confirm/$bogus_timestamp/" . user_pass_rehash($account->pass, $bogus_timestamp, $account->login, $account->uid));

    $this->assertText(t('You have tried to use an account cancellation link that has expired. Please request a new one using the form below.'), 'Expired cancel account request rejected.');

    $accounts = user_load_multiple(array($account->uid), array('status' => 1));

    $this->assertTrue(reset($accounts), 'User account was not canceled.');

    // Confirm user's content has not been altered.

    $test_node = node_load($node->nid, NULL, TRUE);

    $this->assertTrue(($test_node->uid == $account->uid && $test_node->status == 1), 'Node of the user has not been altered.');

  }

  /**

   * Disable account and keep all content.

   */

  function testUserBlock() {

    variable_set('user_cancel_method', 'user_cancel_block');

    // Create a user.

    $web_user = $this->drupalCreateUser(array('cancel account'));

    $this->drupalLogin($web_user);

    // Load real user object.

    $account = user_load($web_user->uid, TRUE);

    // Attempt to cancel account.

    $this->drupalGet('user/' . $account->uid . '/edit');

    $this->drupalPost(NULL, NULL, t('Cancel account'));

    $this->assertText(t('Are you sure you want to cancel your account?'), 'Confirmation form to cancel account displayed.');

    $this->assertText(t('Your account will be blocked and you will no longer be able to log in. All of your content will remain attributed to your user name.'), 'Informs that all content will be remain as is.');

    $this->assertNoText(t('Select the method to cancel the account above.'), 'Does not allow user to select account cancellation method.');

    // Confirm account cancellation.

    $timestamp = time();

    $this->drupalPost(NULL, NULL, t('Cancel account'));

    $this->assertText(t('A confirmation request to cancel your account has been sent to your e-mail address.'), 'Account cancellation request mailed message displayed.');

    // Confirm account cancellation request.

    $this->drupalGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid));

    $account = user_load($account->uid, TRUE);

    $this->assertTrue($account->status == 0, 'User has been blocked.');

    // Confirm that the confirmation message made it through to the end user.

    $this->assertRaw(t('%name has been disabled.', array('%name' => $account->name)), "Confirmation message displayed to user.");

  }

  /**

   * Disable account and unpublish all content.

   */

  function testUserBlockUnpublish() {

    variable_set('user_cancel_method', 'user_cancel_block_unpublish');

    // Create a user.

    $account = $this->drupalCreateUser(array('cancel account'));

    $this->drupalLogin($account);

    // Load real user object.

    $account = user_load($account->uid, TRUE);

    // Create a node with two revisions.

    $node = $this->drupalCreateNode(array('uid' => $account->uid));

    $settings = get_object_vars($node);

    $settings['revision'] = 1;

    $node = $this->drupalCreateNode($settings);

    // Attempt to cancel account.

    $this->drupalGet('user/' . $account->uid . '/edit');

    $this->drupalPost(NULL, NULL, t('Cancel account'));

    $this->assertText(t('Are you sure you want to cancel your account?'), 'Confirmation form to cancel account displayed.');

    $this->assertText(t('Your account will be blocked and you will no longer be able to log in. All of your content will be hidden from everyone but administrators.'), 'Informs that all content will be unpublished.');

    // Confirm account cancellation.

    $timestamp = time();

    $this->drupalPost(NULL, NULL, t('Cancel account'));

    $this->assertText(t('A confirmation request to cancel your account has been sent to your e-mail address.'), 'Account cancellation request mailed message displayed.');

    // Confirm account cancellation request.

    $this->drupalGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid));

    $account = user_load($account->uid, TRUE);

    $this->assertTrue($account->status == 0, 'User has been blocked.');

    // Confirm user's content has been unpublished.

    $test_node = node_load($node->nid, NULL, TRUE);

    $this->assertTrue($test_node->status == 0, 'Node of the user has been unpublished.');

    $test_node = node_load($node->nid, $node->vid, TRUE);

    $this->assertTrue($test_node->status == 0, 'Node revision of the user has been unpublished.');

    // Confirm that the confirmation message made it through to the end user.

    $this->assertRaw(t('%name has been disabled.', array('%name' => $account->name)), "Confirmation message displayed to user.");

  }

  /**

   * Delete account and anonymize all content.

   */

  function testUserAnonymize() {

    variable_set('user_cancel_method', 'user_cancel_reassign');

    // Create a user.

    $account = $this->drupalCreateUser(array('cancel account'));

    $this->drupalLogin($account);

    // Load real user object.

    $account = user_load($account->uid, TRUE);

    // Create a simple node.

    $node = $this->drupalCreateNode(array('uid' => $account->uid));

    // Create a node with two revisions, the initial one belonging to the

    // cancelling user.

    $revision_node = $this->drupalCreateNode(array('uid' => $account->uid));

    $revision = $revision_node->vid;

    $settings = get_object_vars($revision_node);

    $settings['revision'] = 1;

    $settings['uid'] = 1; // Set new/current revision to someone else.

    $revision_node = $this->drupalCreateNode($settings);

    // Attempt to cancel account.

    $this->drupalGet('user/' . $account->uid . '/edit');

    $this->drupalPost(NULL, NULL, t('Cancel account'));

    $this->assertText(t('Are you sure you want to cancel your account?'), 'Confirmation form to cancel account displayed.');

    $this->assertRaw(t('Your account will be removed and all account information deleted. All of your content will be assigned to the %anonymous-name user.', array('%anonymous-name' => variable_get('anonymous', t('Anonymous')))), 'Informs that all content will be attributed to anonymous account.');

    // Confirm account cancellation.

    $timestamp = time();

    $this->drupalPost(NULL, NULL, t('Cancel account'));

    $this->assertText(t('A confirmation request to cancel your account has been sent to your e-mail address.'), 'Account cancellation request mailed message displayed.');

    // Confirm account cancellation request.

    $this->drupalGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid));

    $this->assertFalse(user_load($account->uid, TRUE), 'User is not found in the database.');

    // Confirm that user's content has been attributed to anonymous user.

    $test_node = node_load($node->nid, NULL, TRUE);

    $this->assertTrue(($test_node->uid == 0 && $test_node->status == 1), 'Node of the user has been attributed to anonymous user.');

    $test_node = node_load($revision_node->nid, $revision, TRUE);

    $this->assertTrue(($test_node->revision_uid == 0 && $test_node->status == 1), 'Node revision of the user has been attributed to anonymous user.');

    $test_node = node_load($revision_node->nid, NULL, TRUE);

    $this->assertTrue(($test_node->uid != 0 && $test_node->status == 1), "Current revision of the user's node was not attributed to anonymous user.");

    // Confirm that the confirmation message made it through to the end user.

    $this->assertRaw(t('%name has been deleted.', array('%name' => $account->name)), "Confirmation message displayed to user.");

  }

  /**

   * Delete account and remove all content.

   */

  function testUserDelete() {

    variable_set('user_cancel_method', 'user_cancel_delete');

    // Create a user.

    $account = $this->drupalCreateUser(array('cancel account', 'post comments', 'skip comment approval'));

    $this->drupalLogin($account);

    // Load real user object.

    $account = user_load($account->uid, TRUE);

    // Create a simple node.

    $node = $this->drupalCreateNode(array('uid' => $account->uid));

    // Create comment.

    $langcode = LANGUAGE_NONE;

    $edit = array();

    $edit['subject'] = $this->randomName(8);

    $edit['comment_body[' . $langcode . '][0][value]'] = $this->randomName(16);

    $this->drupalPost('comment/reply/' . $node->nid, $edit, t('Preview'));

    $this->drupalPost(NULL, array(), t('Save'));

    $this->assertText(t('Your comment has been posted.'));

    $comments = comment_load_multiple(array(), array('subject' => $edit['subject']));

    $comment = reset($comments);

    $this->assertTrue($comment->cid, 'Comment found.');

    // Create a node with two revisions, the initial one belonging to the

    // cancelling user.

    $revision_node = $this->drupalCreateNode(array('uid' => $account->uid));

    $revision = $revision_node->vid;

    $settings = get_object_vars($revision_node);

    $settings['revision'] = 1;

    $settings['uid'] = 1; // Set new/current revision to someone else.

    $revision_node = $this->drupalCreateNode($settings);

    // Attempt to cancel account.

    $this->drupalGet('user/' . $account->uid . '/edit');

    $this->drupalPost(NULL, NULL, t('Cancel account'));

    $this->assertText(t('Are you sure you want to cancel your account?'), 'Confirmation form to cancel account displayed.');

    $this->assertText(t('Your account will be removed and all account information deleted. All of your content will also be deleted.'), 'Informs that all content will be deleted.');

    // Confirm account cancellation.

    $timestamp = time();

    $this->drupalPost(NULL, NULL, t('Cancel account'));

    $this->assertText(t('A confirmation request to cancel your account has been sent to your e-mail address.'), 'Account cancellation request mailed message displayed.');

    // Confirm account cancellation request.

    $this->drupalGet("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login, $account->uid));

    $this->assertFalse(user_load($account->uid, TRUE), 'User is not found in the database.');

    // Confirm that user's content has been deleted.

    $this->assertFalse(node_load($node->nid, NULL, TRUE), 'Node of the user has been deleted.');

    $this->assertFalse(node_load($node->nid, $revision, TRUE), 'Node revision of the user has been deleted.');

    $this->assertTrue(node_load($revision_node->nid, NULL, TRUE), "Current revision of the user's node was not deleted.");

    $this->assertFalse(comment_load($comment->cid), 'Comment of the user has been deleted.');

    // Confirm that the confirmation message made it through to the end user.

    $this->assertRaw(t('%name has been deleted.', array('%name' => $account->name)), "Confirmation message displayed to user.");

  }

  /**

   * Create an administrative user and delete another user.

   */

  function testUserCancelByAdmin() {

    variable_set('user_cancel_method', 'user_cancel_reassign');

    // Create a regular user.

    $account = $this->drupalCreateUser(array());

    // Create administrative user.

    $admin_user = $this->drupalCreateUser(array('administer users'));

    $this->drupalLogin($admin_user);

    // Delete regular user.

    $this->drupalGet('user/' . $account->uid . '/edit');

    $this->drupalPost(NULL, NULL, t('Cancel account'));

    $this->assertRaw(t('Are you sure you want to cancel the account %name?', array('%name' => $account->name)), 'Confirmation form to cancel account displayed.');

    $this->assertText(t('Select the method to cancel the account above.'), 'Allows to select account cancellation method.');

    // Confirm deletion.

    $this->drupalPost(NULL, NULL, t('Cancel account'));

    $this->assertRaw(t('%name has been deleted.', array('%name' => $account->name)), 'User deleted.');

    $this->assertFalse(user_load($account->uid), 'User is not found in the database.');

  }

  /**

   * Create an administrative user and mass-delete other users.

   */

  function testMassUserCancelByAdmin() {

    variable_set('user_cancel_method', 'user_cancel_reassign');

    // Enable account cancellation notification.

    variable_set('user_mail_status_canceled_notify', TRUE);

    // Create administrative user.

    $admin_user = $this->drupalCreateUser(array('administer users'));

    $this->drupalLogin($admin_user);

    // Create some users.

    $users = array();

    for ($i = 0; $i < 3; $i++) {

      $account = $this->drupalCreateUser(array());

      $users[$account->uid] = $account;

    }

    // Cancel user accounts, including own one.

    $edit = array();

    $edit['operation'] = 'cancel';

    foreach ($users as $uid => $account) {

      $edit['accounts[' . $uid . ']'] = TRUE;

    }

    $edit['accounts[' . $admin_user->uid . ']'] = TRUE;

    // Also try to cancel uid 1.

    $edit['accounts[1]'] = TRUE;

    $this->drupalPost('admin/people', $edit, t('Update'));

    $this->assertText(t('Are you sure you want to cancel these user accounts?'), 'Confirmation form to cancel accounts displayed.');

    $this->assertText(t('When cancelling these accounts'), 'Allows to select account cancellation method.');

    $this->assertText(t('Require e-mail confirmation to cancel account.'), 'Allows to send confirmation mail.');

    $this->assertText(t('Notify user when account is canceled.'), 'Allows to send notification mail.');

    // Confirm deletion.

    $this->drupalPost(NULL, NULL, t('Cancel accounts'));

    $status = TRUE;

    foreach ($users as $account) {

      $status = $status && (strpos($this->content, t('%name has been deleted.', array('%name' => $account->name))) !== FALSE);

      $status = $status && !user_load($account->uid, TRUE);

    }

    $this->assertTrue($status, 'Users deleted and not found in the database.');

    // Ensure that admin account was not cancelled.

    $this->assertText(t('A confirmation request to cancel your account has been sent to your e-mail address.'), 'Account cancellation request mailed message displayed.');

    $admin_user = user_load($admin_user->uid);

    $this->assertTrue($admin_user->status == 1, 'Administrative user is found in the database and enabled.');

    // Verify that uid 1's account was not cancelled.

    $user1 = user_load(1, TRUE);

    $this->assertEqual($user1->status, 1, 'User #1 still exists and is not blocked.');

  }

}

class UserPictureTestCase extends DrupalWebTestCase {

  protected $user;

  protected $_directory_test;

  public static function getInfo() {

    return array(

      'name' => 'Upload user picture',

      'description' => 'Assure that dimension check, extension check and image scaling work as designed.',

      'group' => 'User'

    );

  }

  function setUp() {

    parent::setUp();

    // Enable user pictures.

    variable_set('user_pictures', 1);

    $this->user = $this->drupalCreateUser();

    // Test if directories specified in settings exist in filesystem.

    $file_dir = 'public://';

    $file_check = file_prepare_directory($file_dir, FILE_CREATE_DIRECTORY);

    // TODO: Test public and private methods?

    $picture_dir = variable_get('user_picture_path', 'pictures');

    $picture_path = $file_dir . $picture_dir;

    $pic_check = file_prepare_directory($picture_path, FILE_CREATE_DIRECTORY);

    $this->_directory_test = is_writable($picture_path);

    $this->assertTrue($this->_directory_test, "The directory $picture_path doesn't exist or is not writable. Further tests won't be made.");

  }

  function testNoPicture() {

    $this->drupalLogin($this->user);

    // Try to upload a file that is not an image for the user picture.

    $not_an_image = current($this->drupalGetTestFiles('html'));

    $this->saveUserPicture($not_an_image);

    $this->assertRaw(t('Only JPEG, PNG and GIF images are allowed.'), 'Non-image files are not accepted.');

  }

  /**

   * Do the test:

   *  GD Toolkit is installed

   *  Picture has invalid dimension

   *

   * results: The image should be uploaded because ImageGDToolkit resizes the picture

   */

  function testWithGDinvalidDimension() {

    if ($this->_directory_test && image_get_toolkit()) {

      $this->drupalLogin($this->user);

      $image = current($this->drupalGetTestFiles('image'));

      $info = image_get_info($image->uri);

      // Set new variables: invalid dimensions, valid filesize (0 = no limit).

      $test_dim = ($info['width'] - 10) . 'x' . ($info['height'] - 10);

      variable_set('user_picture_dimensions', $test_dim);

      variable_set('user_picture_file_size', 0);

      $pic_path = $this->saveUserPicture($image);

      // Check that the image was resized and is being displayed on the

      // user's profile page.

      $text = t('The image was resized to fit within the maximum allowed dimensions of %dimensions pixels.', array('%dimensions' => $test_dim));

      $this->assertRaw($text, 'Image was resized.');

      $alt = t("@user's picture", array('@user' => format_username($this->user)));

      $style = variable_get('user_picture_style', '');

      $this->assertRaw(check_plain(image_style_url($style, $pic_path)), "Image is displayed in user's edit page");

      // Check if file is located in proper directory.

      $this->assertTrue(is_file($pic_path), "File is located in proper directory");

    }

  }

  /**

   * Do the test:

   *  GD Toolkit is installed

   *  Picture has invalid size

   *

   * results: The image should be uploaded because ImageGDToolkit resizes the picture

   */

  function testWithGDinvalidSize() {

    if ($this->_directory_test && image_get_toolkit()) {

      $this->drupalLogin($this->user);

      // Images are sorted first by size then by name. We need an image

      // bigger than 1 KB so we'll grab the last one.

      $files = $this->drupalGetTestFiles('image');

      $image = end($files);

      $info = image_get_info($image->uri);

      // Set new variables: valid dimensions, invalid filesize.

      $test_dim = ($info['width'] + 10) . 'x' . ($info['height'] + 10);

      $test_size = 1;

      variable_set('user_picture_dimensions', $test_dim);

      variable_set('user_picture_file_size', $test_size);

      $pic_path = $this->saveUserPicture($image);

      // Test that the upload failed and that the correct reason was cited.

      $text = t('The specified file %filename could not be uploaded.', array('%filename' => $image->filename));

      $this->assertRaw($text, 'Upload failed.');

      $text = t('The file is %filesize exceeding the maximum file size of %maxsize.', array('%filesize' => format_size(filesize($image->uri)), '%maxsize' => format_size($test_size * 1024)));

      $this->assertRaw($text, 'File size cited as reason for failure.');

      // Check if file is not uploaded.

      $this->assertFalse(is_file($pic_path), 'File was not uploaded.');

    }

  }

  /**

   * Do the test:

   *  GD Toolkit is not installed

   *  Picture has invalid size

   *

   * results: The image shouldn't be uploaded

   */

  function testWithoutGDinvalidDimension() {

    if ($this->_directory_test && !image_get_toolkit()) {

      $this->drupalLogin($this->user);

      $image = current($this->drupalGetTestFiles('image'));

      $info = image_get_info($image->uri);

      // Set new variables: invalid dimensions, valid filesize (0 = no limit).

      $test_dim = ($info['width'] - 10) . 'x' . ($info['height'] - 10);

      variable_set('user_picture_dimensions', $test_dim);

      variable_set('user_picture_file_size', 0);

      $pic_path = $this->saveUserPicture($image);

      // Test that the upload failed and that the correct reason was cited.

      $text = t('The specified file %filename could not be uploaded.', array('%filename' => $image->filename));

      $this->assertRaw($text, 'Upload failed.');

      $text = t('The image is too large; the maximum dimensions are %dimensions pixels.', array('%dimensions' => $test_dim));

      $this->assertRaw($text, 'Checking response on invalid image (dimensions).');

      // Check if file is not uploaded.

      $this->assertFalse(is_file($pic_path), 'File was not uploaded.');

    }

  }

  /**

   * Do the test:

   *  GD Toolkit is not installed

   *  Picture has invalid size

   *

   * results: The image shouldn't be uploaded

   */

  function testWithoutGDinvalidSize() {

    if ($this->_directory_test && !image_get_toolkit()) {

      $this->drupalLogin($this->user);

      $image = current($this->drupalGetTestFiles('image'));

      $info = image_get_info($image->uri);

      // Set new variables: valid dimensions, invalid filesize.

      $test_dim = ($info['width'] + 10) . 'x' . ($info['height'] + 10);

      $test_size = 1;

      variable_set('user_picture_dimensions', $test_dim);

      variable_set('user_picture_file_size', $test_size);

      $pic_path = $this->saveUserPicture($image);

      // Test that the upload failed and that the correct reason was cited.

      $text = t('The specified file %filename could not be uploaded.', array('%filename' => $image->filename));

      $this->assertRaw($text, 'Upload failed.');

      $text = t('The file is %filesize exceeding the maximum file size of %maxsize.', array('%filesize' => format_size(filesize($image->uri)), '%maxsize' => format_size($test_size * 1024)));

      $this->assertRaw($text, 'File size cited as reason for failure.');

      // Check if file is not uploaded.

      $this->assertFalse(is_file($pic_path), 'File was not uploaded.');

    }

  }

  /**

   * Do the test:

   *  Picture is valid (proper size and dimension)

   *

   * results: The image should be uploaded

   */

  function testPictureIsValid() {

    if ($this->_directory_test) {

      $this->drupalLogin($this->user);

      $image = current($this->drupalGetTestFiles('image'));

      $info = image_get_info($image->uri);

      // Set new variables: valid dimensions, valid filesize (0 = no limit).

      $test_dim = ($info['width'] + 10) . 'x' . ($info['height'] + 10);

      variable_set('user_picture_dimensions', $test_dim);

      variable_set('user_picture_file_size', 0);

      $pic_path = $this->saveUserPicture($image);

      // Check if image is displayed in user's profile page.

      $this->drupalGet('user');

      $this->assertRaw(file_uri_target($pic_path), "Image is displayed in user's profile page");

      // Check if file is located in proper directory.

      $this->assertTrue(is_file($pic_path), 'File is located in proper directory');

      // Set new picture dimensions.

      $test_dim = ($info['width'] + 5) . 'x' . ($info['height'] + 5);

      variable_set('user_picture_dimensions', $test_dim);

      $pic_path2 = $this->saveUserPicture($image);

      $this->assertNotEqual($pic_path, $pic_path2, 'Filename of second picture is different.');

      // Check if user picture has a valid file ID after saving the user.

      $account = user_load($this->user->uid, TRUE);

      $this->assertTrue(is_object($account->picture), 'User picture object is valid after user load.');

      $this->assertNotNull($account->picture->fid, 'User picture object has a FID after user load.');

      $this->assertTrue(is_file($account->picture->uri), 'File is located in proper directory after user load.');

      user_save($account);

      // Verify that the user save does not destroy the user picture object.

      $this->assertTrue(is_object($account->picture), 'User picture object is valid after user save.');

      $this->assertNotNull($account->picture->fid, 'User picture object has a FID after user save.');

      $this->assertTrue(is_file($account->picture->uri), 'File is located in proper directory after user save.');

    }

  }

  /**

   * Test HTTP schema working with user pictures.

   */

  function testExternalPicture() {

    $this->drupalLogin($this->user);

    // Set the default picture to an URI with a HTTP schema.

    $images = $this->drupalGetTestFiles('image');

    $image = $images[0];

    $pic_path = file_create_url($image->uri);

    variable_set('user_picture_default', $pic_path);

    // Check if image is displayed in user's profile page.

    $this->drupalGet('user');

    // Get the user picture image via xpath.

    $elements = $this->xpath('//div[@class="user-picture"]/img');

    $this->assertEqual(count($elements), 1, "There is exactly one user picture on the user's profile page");

    $this->assertEqual($pic_path, (string) $elements[0]['src'], "User picture source is correct.");

  }

  /**

   * Tests deletion of user pictures.

   */

  function testDeletePicture() {

    $this->drupalLogin($this->user);

    $image = current($this->drupalGetTestFiles('image'));

    $info = image_get_info($image->uri);

    // Set new variables: valid dimensions, valid filesize (0 = no limit).

    $test_dim = ($info['width'] + 10) . 'x' . ($info['height'] + 10);

    variable_set('user_picture_dimensions', $test_dim);

    variable_set('user_picture_file_size', 0);

    // Save a new picture.

    $edit = array('files[picture_upload]' => drupal_realpath($image->uri));

    $this->drupalPost('user/' . $this->user->uid . '/edit', $edit, t('Save'));

    // Load actual user data from database.

    $account = user_load($this->user->uid, TRUE);

    $pic_path = isset($account->picture) ? $account->picture->uri : NULL;

    // Check if image is displayed in user's profile page.

    $this->drupalGet('user');

    $this->assertRaw(file_uri_target($pic_path), "Image is displayed in user's profile page");

    // Check if file is located in proper directory.

    $this->assertTrue(is_file($pic_path), 'File is located in proper directory');

    $edit = array('picture_delete' => 1);

    $this->drupalPost('user/' . $this->user->uid . '/edit', $edit, t('Save'));

    // Load actual user data from database.

    $account1 = user_load($this->user->uid, TRUE);

    $this->assertNull($account1->picture, 'User object has no picture');

    $file = file_load($account->picture->fid);

    $this->assertFalse($file, 'File is removed from database');

    // Clear out PHP's file stat cache so we see the current value.

    clearstatcache();

    $this->assertFalse(is_file($pic_path), 'File is removed from file system');

  }

  function saveUserPicture($image) {

    $edit = array('files[picture_upload]' => drupal_realpath($image->uri));

    $this->drupalPost('user/' . $this->user->uid . '/edit', $edit, t('Save'));

    // Load actual user data from database.

    $account = user_load($this->user->uid, TRUE);

    return isset($account->picture) ? $account->picture->uri : NULL;

  }

  /**

   * Tests the admin form validates user picture settings.

   */

  function testUserPictureAdminFormValidation() {

    $this->drupalLogin($this->drupalCreateUser(array('administer users')));

    // The default values are valid.

    $this->drupalPost('admin/config/people/accounts', array(), t('Save configuration'));

    $this->assertText(t('The configuration options have been saved.'), 'The default values are valid.');

    // The form does not save with an invalid file size.

    $edit = array(

      'user_picture_file_size' => $this->randomName(),

    );

    $this->drupalPost('admin/config/people/accounts', $edit, t('Save configuration'));

    $this->assertNoText(t('The configuration options have been saved.'), 'The form does not save with an invalid file size.');

  }

}

class UserPermissionsTestCase extends DrupalWebTestCase {

  protected $admin_user;

  protected $rid;

  public static function getInfo() {

    return array(

      'name' => 'Role permissions',

      'description' => 'Verify that role permissions can be added and removed via the permissions page.',

      'group' => 'User'

    );

  }

  function setUp() {

    parent::setUp();

    $this->admin_user = $this->drupalCreateUser(array('administer permissions', 'access user profiles', 'administer site configuration', 'administer modules', 'administer users'));

    // Find the new role ID - it must be the maximum.

    $all_rids = array_keys($this->admin_user->roles);

    sort($all_rids);

    $this->rid = array_pop($all_rids);

  }

  /**

   * Change user permissions and check user_access().

   */

  function testUserPermissionChanges() {

    $this->drupalLogin($this->admin_user);

    $rid = $this->rid;

    $account = $this->admin_user;

    // Add a permission.

    $this->assertFalse(user_access('administer nodes', $account), 'User does not have "administer nodes" permission.');

    $edit = array();

    $edit[$rid . '[administer nodes]'] = TRUE;

    $this->drupalPost('admin/people/permissions', $edit, t('Save permissions'));

    $this->assertText(t('The changes have been saved.'), 'Successful save message displayed.');

    drupal_static_reset('user_access');

    drupal_static_reset('user_role_permissions');

    $this->assertTrue(user_access('administer nodes', $account), 'User now has "administer nodes" permission.');

    // Remove a permission.

    $this->assertTrue(user_access('access user profiles', $account), 'User has "access user profiles" permission.');

    $edit = array();

    $edit[$rid . '[access user profiles]'] = FALSE;

    $this->drupalPost('admin/people/permissions', $edit, t('Save permissions'));

    $this->assertText(t('The changes have been saved.'), 'Successful save message displayed.');

    drupal_static_reset('user_access');

    drupal_static_reset('user_role_permissions');

    $this->assertFalse(user_access('access user profiles', $account), 'User no longer has "access user profiles" permission.');

  }

  /**

   * Test assigning of permissions for the administrator role.

   */

  function testAdministratorRole() {

    $this->drupalLogin($this->admin_user);

    $this->drupalGet('admin/config/people/accounts');

    // Set the user's role to be the administrator role.

    $edit = array();

    $edit['user_admin_role'] = $this->rid;

    $this->drupalPost('admin/config/people/accounts', $edit, t('Save configuration'));

    // Enable aggregator module and ensure the 'administer news feeds'

    // permission is assigned by default.

    $edit = array();

    $edit['modules[Core][aggregator][enable]'] = TRUE;

    $this->drupalPost('admin/modules', $edit, t('Save configuration'));

    $this->assertTrue(user_access('administer news feeds', $this->admin_user), 'The permission was automatically assigned to the administrator role');

  }

  /**

   * Verify proper permission changes by user_role_change_permissions().

   */

  function testUserRoleChangePermissions() {

    $rid = $this->rid;

    $account = $this->admin_user;

    // Verify current permissions.

    $this->assertFalse(user_access('administer nodes', $account), 'User does not have "administer nodes" permission.');

    $this->assertTrue(user_access('access user profiles', $account), 'User has "access user profiles" permission.');

    $this->assertTrue(user_access('administer site configuration', $account), 'User has "administer site configuration" permission.');