silverstripe / cwp-core

tests/CwpControllerExtensionTest.php

Indentation +75 added lines, -75 removed lines

@@ -20,104 +20,104 @@
  */
 class CwpControllerExtensionTest extends SapphireTest
 {
-    /**
-     * @var Controller
-     */
-    protected $controller;
+	/**
+	 * @var Controller
+	 */
+	protected $controller;
 
-    /**
-     * @var CanonicalURLMiddleware
-     */
-    protected $middlewareMock;
+	/**
+	 * @var CanonicalURLMiddleware
+	 */
+	protected $middlewareMock;
 
-    protected function setUp()
-    {
-        parent::setUp();
+	protected function setUp()
+	{
+		parent::setUp();
 
-        $this->logOut();
+		$this->logOut();
 
-        $this->controller = new Controller();
+		$this->controller = new Controller();
 
-        $request = new HTTPRequest('GET', '/');
-        $request->setSession(new Session([]));
+		$request = new HTTPRequest('GET', '/');
+		$request->setSession(new Session([]));
 
-        $this->controller->setRequest($request);
+		$this->controller->setRequest($request);
 
-        $this->middlewareMock = $this->getMockBuilder(CanonicalURLMiddleware::class)
-            ->setMethods(['setForceSSL'])
-            ->getMock();
+		$this->middlewareMock = $this->getMockBuilder(CanonicalURLMiddleware::class)
+			->setMethods(['setForceSSL'])
+			->getMock();
 
-        Injector::inst()->registerService($this->middlewareMock, CanonicalURLMiddleware::class);
-    }
+		Injector::inst()->registerService($this->middlewareMock, CanonicalURLMiddleware::class);
+	}
 
-    public function testRedirectsSSLToDomain()
-    {
-        Config::modify()->set(Director::class, 'alternate_base_url', 'http://nothttps.local');
+	public function testRedirectsSSLToDomain()
+	{
+		Config::modify()->set(Director::class, 'alternate_base_url', 'http://nothttps.local');
 
-        // Expecting this to call forceSSL to forcedomain.org.
-        $this->middlewareMock->expects($this->once())
-            ->method('setForceSSL')
-            ->with(true)
-            ->will($this->returnSelf());
+		// Expecting this to call forceSSL to forcedomain.org.
+		$this->middlewareMock->expects($this->once())
+			->method('setForceSSL')
+			->with(true)
+			->will($this->returnSelf());
 
-        Config::modify()->set(CwpControllerExtension::class, 'ssl_redirection_enabled', true);
-        Config::modify()->set(CwpControllerExtension::class, 'ssl_redirection_force_domain', 'forcedomain.org');
+		Config::modify()->set(CwpControllerExtension::class, 'ssl_redirection_enabled', true);
+		Config::modify()->set(CwpControllerExtension::class, 'ssl_redirection_force_domain', 'forcedomain.org');
 
-        $this->controller->handleRequest($this->controller->getRequest());
-    }
+		$this->controller->handleRequest($this->controller->getRequest());
+	}
 
-    public function testRedirectsSSLToCurrentDomain()
-    {
-        Config::modify()->set(Director::class, 'alternate_base_url', 'http://nothttps.local');
+	public function testRedirectsSSLToCurrentDomain()
+	{
+		Config::modify()->set(Director::class, 'alternate_base_url', 'http://nothttps.local');
 
-        // Expecting this to call forceSSL to current domain.
-        $this->middlewareMock->expects($this->once())
-            ->method('setForceSSL')
-            ->will($this->returnSelf());
+		// Expecting this to call forceSSL to current domain.
+		$this->middlewareMock->expects($this->once())
+			->method('setForceSSL')
+			->will($this->returnSelf());
 
-        Config::modify()->set(CwpControllerExtension::class, 'ssl_redirection_enabled', true);
-        Config::modify()->set(CwpControllerExtension::class, 'ssl_redirection_force_domain', false);
+		Config::modify()->set(CwpControllerExtension::class, 'ssl_redirection_enabled', true);
+		Config::modify()->set(CwpControllerExtension::class, 'ssl_redirection_force_domain', false);
 
-        $this->controller->handleRequest($this->controller->getRequest());
-    }
+		$this->controller->handleRequest($this->controller->getRequest());
+	}
 
-    public function testRequiresLoginForTest()
-    {
-        Injector::inst()->get(Kernel::class)->setEnvironment('test');
+	public function testRequiresLoginForTest()
+	{
+		Injector::inst()->get(Kernel::class)->setEnvironment('test');
 
-        try {
-            $this->controller->handleRequest($this->controller->getRequest());
-        } catch (Exception $e) {
-            $this->assertEquals($e->getResponse()->getStatusCode(), '401', 'Forces BasicAuth on test');
+		try {
+			$this->controller->handleRequest($this->controller->getRequest());
+		} catch (Exception $e) {
+			$this->assertEquals($e->getResponse()->getStatusCode(), '401', 'Forces BasicAuth on test');
 
-            // We need to pop manually, since throwing an SS_HTTPResponse_Exception in onBeforeInit hijacks
-            // the normal Controller control flow and confuses TestRunner (as they share global controller stack).
-            $this->controller->popCurrent();
-        }
-    }
+			// We need to pop manually, since throwing an SS_HTTPResponse_Exception in onBeforeInit hijacks
+			// the normal Controller control flow and confuses TestRunner (as they share global controller stack).
+			$this->controller->popCurrent();
+		}
+	}
 
-    public function testRequiresLoginForNonTest()
-    {
-        Injector::inst()->get(Kernel::class)->setEnvironment('live');
+	public function testRequiresLoginForNonTest()
+	{
+		Injector::inst()->get(Kernel::class)->setEnvironment('live');
 
-        $response = $this->controller->handleRequest($this->controller->getRequest());
-        $this->assertEquals($response->getStatusCode(), '200', 'Does not force BasicAuth on live');
-    }
+		$response = $this->controller->handleRequest($this->controller->getRequest());
+		$this->assertEquals($response->getStatusCode(), '200', 'Does not force BasicAuth on live');
+	}
 
-    public function testRequiresLoginForLiveWhenEnabled()
-    {
-        Config::modify()->set(CwpControllerExtension::class, 'live_basicauth_enabled', true);
+	public function testRequiresLoginForLiveWhenEnabled()
+	{
+		Config::modify()->set(CwpControllerExtension::class, 'live_basicauth_enabled', true);
 
-        Injector::inst()->get(Kernel::class)->setEnvironment('live');
+		Injector::inst()->get(Kernel::class)->setEnvironment('live');
 
-        try {
-            $this->controller->handleRequest($this->controller->getRequest());
-        } catch (Exception $e) {
-            $this->assertEquals($e->getResponse()->getStatusCode(), '401', 'Forces BasicAuth on live (optionally)');
+		try {
+			$this->controller->handleRequest($this->controller->getRequest());
+		} catch (Exception $e) {
+			$this->assertEquals($e->getResponse()->getStatusCode(), '401', 'Forces BasicAuth on live (optionally)');
 
-            // We need to pop manually, since throwing an SS_HTTPResponse_Exception in onBeforeInit hijacks
-            // the normal Controller control flow and confuses TestRunner (as they share global controller stack).
-            $this->controller->popCurrent();
-        }
-    }
+			// We need to pop manually, since throwing an SS_HTTPResponse_Exception in onBeforeInit hijacks
+			// the normal Controller control flow and confuses TestRunner (as they share global controller stack).
+			$this->controller->popCurrent();
+		}
+	}
 }

tests/AtomFeedTest.php

Indentation +54 added lines, -54 removed lines

@@ -14,67 +14,67 @@
 
 class AtomFeedTest extends SapphireTest
 {
-    protected static $original_host;
+	protected static $original_host;
 
-    public function testAtomFeed()
-    {
-        $list = new ArrayList();
-        $list->push(new ItemA());
-        $list->push(new ItemB());
-        $list->push(new ItemC());
+	public function testAtomFeed()
+	{
+		$list = new ArrayList();
+		$list->push(new ItemA());
+		$list->push(new ItemB());
+		$list->push(new ItemC());
 
-        $atomFeed = new CwpAtomFeed(
-            $list,
-            "http://www.example.com",
-            "Test Atom Feed",
-            "Test Atom Feed Description"
-        );
-        $content = $atomFeed->outputToBrowser();
+		$atomFeed = new CwpAtomFeed(
+			$list,
+			"http://www.example.com",
+			"Test Atom Feed",
+			"Test Atom Feed Description"
+		);
+		$content = $atomFeed->outputToBrowser();
 
-        //Debug::message($content);
-        $this->assertContains('<link href="http://www.example.org/item-a/" />', $content);
-        $this->assertContains('<link href="http://www.example.com/item-b.html" />', $content);
-        $this->assertContains('<link href="http://www.example.com/item-c.html" />', $content);
+		//Debug::message($content);
+		$this->assertContains('<link href="http://www.example.org/item-a/" />', $content);
+		$this->assertContains('<link href="http://www.example.com/item-b.html" />', $content);
+		$this->assertContains('<link href="http://www.example.com/item-c.html" />', $content);
 
-        $this->assertContains('<title type="html">ItemA</title>', $content);
-        $this->assertContains('<title type="html">ItemB</title>', $content);
-        $this->assertContains('<title type="html">ItemC</title>', $content);
+		$this->assertContains('<title type="html">ItemA</title>', $content);
+		$this->assertContains('<title type="html">ItemB</title>', $content);
+		$this->assertContains('<title type="html">ItemC</title>', $content);
 
-        $this->assertContains("\tItemA Content\n", $content);
-        $this->assertContains("\tItemB Content\n", $content);
-        $this->assertContains("\tItemC Content\n", $content);
-    }
+		$this->assertContains("\tItemA Content\n", $content);
+		$this->assertContains("\tItemB Content\n", $content);
+		$this->assertContains("\tItemC Content\n", $content);
+	}
 
-    public function testRenderWithTemplate()
-    {
-        $atomFeed = new CwpAtomFeed(new ArrayList(), "", "", "");
-        $content = $atomFeed->outputToBrowser();
-        // test we have switched from a RSS feed test template tot he AtomFeed template
-        $this->assertNotContains('<title>Test Custom Template</title>', $content);
-    }
+	public function testRenderWithTemplate()
+	{
+		$atomFeed = new CwpAtomFeed(new ArrayList(), "", "", "");
+		$content = $atomFeed->outputToBrowser();
+		// test we have switched from a RSS feed test template tot he AtomFeed template
+		$this->assertNotContains('<title>Test Custom Template</title>', $content);
+	}
 
-    public function testLinkToFeed()
-    {
-        $link = AtomTagsStub::linkToFeed('atomLinkUrl', 'Atom feed of this blog');
-        $this->assertContains('atomLinkUrl', $link);
-        $this->assertContains('Atom feed of this blog', $link);
-        $this->assertContains('application/atom+xml', $link);
-    }
+	public function testLinkToFeed()
+	{
+		$link = AtomTagsStub::linkToFeed('atomLinkUrl', 'Atom feed of this blog');
+		$this->assertContains('atomLinkUrl', $link);
+		$this->assertContains('Atom feed of this blog', $link);
+		$this->assertContains('application/atom+xml', $link);
+	}
 
-    protected function setUp()
-    {
-        parent::setUp();
-        Config::modify()->set(Director::class, 'alternate_base_url', '/');
-        if (!self::$original_host) {
-            self::$original_host = $_SERVER['HTTP_HOST'];
-        }
-        $_SERVER['HTTP_HOST'] = 'www.example.org';
-    }
+	protected function setUp()
+	{
+		parent::setUp();
+		Config::modify()->set(Director::class, 'alternate_base_url', '/');
+		if (!self::$original_host) {
+			self::$original_host = $_SERVER['HTTP_HOST'];
+		}
+		$_SERVER['HTTP_HOST'] = 'www.example.org';
+	}
 
-    protected function tearDown()
-    {
-        parent::tearDown();
-        Config::modify()->set(Director::class, 'alternate_base_url', null);
-        $_SERVER['HTTP_HOST'] = self::$original_host;
-    }
+	protected function tearDown()
+	{
+		parent::tearDown();
+		Config::modify()->set(Director::class, 'alternate_base_url', null);
+		$_SERVER['HTTP_HOST'] = self::$original_host;
+	}
 }

tests/RichLinksExtensionTest.php

Indentation +28 added lines, -28 removed lines

@@ -7,35 +7,35 @@
 
 class RichLinksExtensionTest extends SapphireTest
 {
-    public function testContentLinkInjections()
-    {
-        $field = new DBText();
+	public function testContentLinkInjections()
+	{
+		$field = new DBText();
 
-        // External links injection.
-        $field->setValue('<a href="http://newzealand.govt.nz">New Zealand Government</a>');
-        $this->assertEquals(
-            $field->RichLinks(),
-            '<a class="external" rel="external" title="Open external link" '
-            . 'href="http://newzealand.govt.nz">New Zealand Government'
-            .'<span class="nonvisual-indicator">(external link)</span></a>',
-            'Injects attributes to external link without target.'
-        );
+		// External links injection.
+		$field->setValue('<a href="http://newzealand.govt.nz">New Zealand Government</a>');
+		$this->assertEquals(
+			$field->RichLinks(),
+			'<a class="external" rel="external" title="Open external link" '
+			. 'href="http://newzealand.govt.nz">New Zealand Government'
+			.'<span class="nonvisual-indicator">(external link)</span></a>',
+			'Injects attributes to external link without target.'
+		);
 
-        $field->setValue('<a href="http://newzealand.govt.nz" target="_blank">New Zealand Government</a>');
-        $this->assertEquals(
-            $field->RichLinks(),
-            '<a class="external" rel="external" title="Open external link" '
-            . 'href="http://newzealand.govt.nz" target="_blank">New Zealand Government'
-            .'<span class="nonvisual-indicator">(external link)</span></a>',
-            'Injects attributes to external link with target, while keeping the existing attributes.'
-        );
+		$field->setValue('<a href="http://newzealand.govt.nz" target="_blank">New Zealand Government</a>');
+		$this->assertEquals(
+			$field->RichLinks(),
+			'<a class="external" rel="external" title="Open external link" '
+			. 'href="http://newzealand.govt.nz" target="_blank">New Zealand Government'
+			.'<span class="nonvisual-indicator">(external link)</span></a>',
+			'Injects attributes to external link with target, while keeping the existing attributes.'
+		);
 
-        // Check the normal links are not affected.
-        $field->setValue('<a href="[sitetree_link,id=1]">Internal</a>');
-        $this->assertEquals(
-            $field->RichLinks(),
-            '<a href="[sitetree_link,id=1]">Internal</a>',
-            'Regular link is not modified.'
-        );
-    }
+		// Check the normal links are not affected.
+		$field->setValue('<a href="[sitetree_link,id=1]">Internal</a>');
+		$this->assertEquals(
+			$field->RichLinks(),
+			'<a href="[sitetree_link,id=1]">Internal</a>',
+			'Regular link is not modified.'
+		);
+	}
 }

tests/CwpStatsReportTest.php

Indentation +27 added lines, -27 removed lines

@@ -9,35 +9,35 @@
 
 class CwpStatsReportTest extends SapphireTest
 {
-    protected static $fixture_file = 'CwpStatsReportTest.yml';
+	protected static $fixture_file = 'CwpStatsReportTest.yml';
 
-    public function testCount()
-    {
-        // Publish all pages apart from page3.
-        $this->objFromFixture(Page::class, 'page1')->publishRecursive();
-        $this->objFromFixture(Page::class, 'page2')->publishRecursive();
-        $this->objFromFixture(Page::class, 'page3')->publishRecursive();
+	public function testCount()
+	{
+		// Publish all pages apart from page3.
+		$this->objFromFixture(Page::class, 'page1')->publishRecursive();
+		$this->objFromFixture(Page::class, 'page2')->publishRecursive();
+		$this->objFromFixture(Page::class, 'page3')->publishRecursive();
 
-        // Add page5s to a subsite, if the module is installed.
-        $page5s = $this->objFromFixture(Page::class, 'page5s');
-        if (class_exists(Subsite::class)) {
-            $subsite = Subsite::create();
-            $subsite->Title = 'subsite';
-            $subsite->write();
+		// Add page5s to a subsite, if the module is installed.
+		$page5s = $this->objFromFixture(Page::class, 'page5s');
+		if (class_exists(Subsite::class)) {
+			$subsite = Subsite::create();
+			$subsite->Title = 'subsite';
+			$subsite->write();
 
-            $page5s->SubsiteID = $subsite->ID;
-            $page5s->write();
-        }
-        $page5s->publishRecursive();
+			$page5s->SubsiteID = $subsite->ID;
+			$page5s->write();
+		}
+		$page5s->publishRecursive();
 
-        $report = CwpStatsReport::create();
-        $records = $report->sourceRecords([])->toArray();
-        $i = 0;
-        $this->assertEquals($records[$i++]['Count'], 4, 'Four pages in total, across locales, subsites, live only.');
-        if (class_exists(Subsite::class)) {
-            $this->assertEquals($records[$i++]['Count'], 3, 'Three pages in the main site, if subsites installed.');
-            $this->assertEquals($records[$i++]['Count'], 1, 'One page in the subsite, if subsites installed');
-        }
-        $this->assertEquals($records[$i++]['Count'], 1, 'One file in total.');
-    }
+		$report = CwpStatsReport::create();
+		$records = $report->sourceRecords([])->toArray();
+		$i = 0;
+		$this->assertEquals($records[$i++]['Count'], 4, 'Four pages in total, across locales, subsites, live only.');
+		if (class_exists(Subsite::class)) {
+			$this->assertEquals($records[$i++]['Count'], 3, 'Three pages in the main site, if subsites installed.');
+			$this->assertEquals($records[$i++]['Count'], 1, 'One page in the subsite, if subsites installed');
+		}
+		$this->assertEquals($records[$i++]['Count'], 1, 'One file in total.');
+	}
 }

tests/AtomFeedTest/AtomTagsStub.php

Indentation +7 added lines, -7 removed lines

@@ -11,11 +11,11 @@
  */
 class AtomTagsStub implements TestOnly
 {
-    public static function linkToFeed($url, $title = null)
-    {
-        $link = '<link rel="alternate" type="application/atom+xml" title="' . $title .
-            '" href="' . $url . '" />';
-        CwpAtomFeed::linkToFeed($url, $title);
-        return $link;
-    }
+	public static function linkToFeed($url, $title = null)
+	{
+		$link = '<link rel="alternate" type="application/atom+xml" title="' . $title .
+			'" href="' . $url . '" />';
+		CwpAtomFeed::linkToFeed($url, $title);
+		return $link;
+	}
 }

tests/AtomFeedTest/ItemC.php

Indentation +29 added lines, -29 removed lines

@@ -7,33 +7,33 @@
 
 class ItemC extends ViewableData implements TestOnly
 {
-    // ItemC tests fields - Title has casting, Content doesn't.
-    private static $casting = [
-        'Title' => 'Varchar',
-        'AltContent' => 'Text',
-    ];
-
-    public $Title = 'ItemC';
-
-    public function Title()
-    {
-        return "ItemC";
-    }
-
-    public function Content()
-    {
-        return "ItemC Content";
-    }
-
-    public $AltContent = "ItemC AltContent";
-
-    public function Link()
-    {
-        return "item-c.html";
-    }
-
-    public function AbsoluteLink()
-    {
-        return "http://www.example.com/item-c.html";
-    }
+	// ItemC tests fields - Title has casting, Content doesn't.
+	private static $casting = [
+		'Title' => 'Varchar',
+		'AltContent' => 'Text',
+	];
+
+	public $Title = 'ItemC';
+
+	public function Title()
+	{
+		return "ItemC";
+	}
+
+	public function Content()
+	{
+		return "ItemC Content";
+	}
+
+	public $AltContent = "ItemC AltContent";
+
+	public function Link()
+	{
+		return "item-c.html";
+	}
+
+	public function AbsoluteLink()
+	{
+		return "http://www.example.com/item-c.html";
+	}
 }

tests/AtomFeedTest/ItemB.php

Indentation +18 added lines, -18 removed lines

@@ -7,26 +7,26 @@
 
 class ItemB extends ViewableData implements TestOnly
 {
-    // ItemB tests without $casting
-    public $Title = 'ItemB';
+	// ItemB tests without $casting
+	public $Title = 'ItemB';
 
-    public function Title()
-    {
-        return "ItemB";
-    }
+	public function Title()
+	{
+		return "ItemB";
+	}
 
-    public function AbsoluteLink()
-    {
-        return "http://www.example.com/item-b.html";
-    }
+	public function AbsoluteLink()
+	{
+		return "http://www.example.com/item-b.html";
+	}
 
-    public function Content()
-    {
-        return "ItemB Content";
-    }
+	public function Content()
+	{
+		return "ItemB Content";
+	}
 
-    public function AltContent()
-    {
-        return "ItemB AltContent";
-    }
+	public function AltContent()
+	{
+		return "ItemB AltContent";
+	}
 }

tests/AtomFeedTest/ItemA.php

Indentation +28 added lines, -28 removed lines

@@ -8,32 +8,32 @@
 
 class ItemA extends ViewableData implements TestOnly
 {
-    // Atom-feed items must have $casting/$db information.
-    private static $casting = [
-        'Title' => 'Varchar',
-        'Content' => 'Text',
-        'AltContent' => 'Text',
-    ];
-
-    public $Title = 'ItemA';
-
-    public function Title()
-    {
-        return "ItemA";
-    }
-
-    public function Content()
-    {
-        return "ItemA Content";
-    }
-
-    public function AltContent()
-    {
-        return "ItemA AltContent";
-    }
-
-    public function Link($action = null)
-    {
-        return Controller::join_links("item-a/", $action);
-    }
+	// Atom-feed items must have $casting/$db information.
+	private static $casting = [
+		'Title' => 'Varchar',
+		'Content' => 'Text',
+		'AltContent' => 'Text',
+	];
+
+	public $Title = 'ItemA';
+
+	public function Title()
+	{
+		return "ItemA";
+	}
+
+	public function Content()
+	{
+		return "ItemA Content";
+	}
+
+	public function AltContent()
+	{
+		return "ItemA AltContent";
+	}
+
+	public function Link($action = null)
+	{
+		return Controller::join_links("item-a/", $action);
+	}
 }

code/extensions/CwpControllerExtension.php

Indentation +190 added lines, -190 removed lines

@@ -18,194 +18,194 @@
 class CwpControllerExtension extends Extension implements PermissionProvider
 {
 
-    /**
-     * Enables SSL redirections - disabling not recommended as it will prevent forcing SSL on admin panel.
-     *
-     * @config
-     * @var bool
-     */
-    private static $ssl_redirection_enabled = true;
-
-    /**
-     * Specify a domain to redirect the vulnerable areas to.
-     *
-     * If left as null, live instance will set this to <instance-id>.cwp.govt.nz via CWP_SECURE_DOMAIN in _config.php.
-     * This allows us to automatically protect vulnerable areas on live even if the frontend cert is not installed.
-     *
-     * Set to false to redirect to https protocol on current domain (e.g. if you have frontend cert).
-     *
-     * Set to a domain string (e.g. 'example.com') to force that domain.
-     *
-     * @config
-     * @var string
-     */
-    private static $ssl_redirection_force_domain = null;
-
-    /**
-     * Enables the BasicAuth protection on all test environments. Disable with caution - it will open up
-     * all your UAT and test environments to the world.
-     *
-     * @config
-     * @var bool
-     */
-    private static $test_basicauth_enabled = true;
-
-    /**
-     * Enables the BasicAuth protection on all live environments.
-     * Useful for securing sites prior to public launch.
-     *
-     * @config
-     * @var bool
-     */
-    private static $live_basicauth_enabled = false;
-
-    /**
-     * This executes the passed callback with subsite filter disabled,
-     * then enabled the filter again before returning the callback result
-     * (or throwing the exception the callback raised)
-     *
-     * @param  callback  $callback - The callback to execute
-     * @return mixed     The result of the callback
-     * @throws Exception Any exception the callback raised
-     */
-    protected function callWithSubsitesDisabled($callback)
-    {
-        $rv = null;
-
-        try {
-            if (class_exists(Subsite::class)) {
-                Subsite::disable_subsite_filter(true);
-            }
-
-            $rv = call_user_func($callback);
-        } catch (Exception $e) {
-            if (class_exists(Subsite::class)) {
-                Subsite::disable_subsite_filter(false);
-            }
-
-            throw $e;
-        }
-
-        if (class_exists(Subsite::class)) {
-            Subsite::disable_subsite_filter(false);
-        }
-
-        return $rv;
-    }
-
-    /**
-     * Trigger Basic Auth protection, except when there's a reason to bypass it
-     *  - The source IP address is in the comma-seperated string in the constant CWP_IP_BYPASS_BASICAUTH
-     *    (so Pingdom, etc, can access the site)
-     *  - There is an identifiable member, that member has the ACCESS_UAT_SERVER permission, and they're trying
-     *    to access a white-list of URLs (so people following a reset password link can reset their password)
-     */
-    protected function triggerBasicAuthProtection()
-    {
-        $allowWithoutAuth = false;
-
-        // Allow whitelisting IPs for bypassing the basic auth.
-        if (Environment::getEnv('CWP_IP_BYPASS_BASICAUTH')) {
-            $remote = $_SERVER['REMOTE_ADDR'];
-            $bypass = explode(',', Environment::getEnv('CWP_IP_BYPASS_BASICAUTH'));
-
-            if (in_array($remote, $bypass)) {
-                $allowWithoutAuth = true;
-            }
-        }
-
-        // First, see if we can get a member to act on, either from a changepassword token or the session
-        if (isset($_REQUEST['m']) && isset($_REQUEST['t'])) {
-            $member = Member::get()->filter('ID', (int) $_REQUEST['m'])->first();
-
-            if (!$member->validateAutoLoginToken($_REQUEST['t'])) {
-                $member = null;
-            }
-        } elseif ($this->owner->getRequest()->getSession()->get('AutoLoginHash')) {
-            $member = Member::member_from_autologinhash(
-                $this->owner->getRequest()->getSession()->get('AutoLoginHash')
-            );
-        } else {
-            $member = Security::getCurrentUser();
-        }
-
-        // Then, if they have the right permissions, check the allowed URLs
-        $existingMemberCanAccessUAT = $member && $this->callWithSubsitesDisabled(function () use ($member) {
-            return Permission::checkMember($member, 'ACCESS_UAT_SERVER');
-        });
-
-        if ($existingMemberCanAccessUAT) {
-            $allowed = array(
-                '/^Security\/changepassword/',
-                '/^Security\/ChangePasswordForm/'
-            );
-
-            $relativeURL = Director::makeRelative(Director::absoluteURL($_SERVER['REQUEST_URI']));
-
-            foreach ($allowed as $pattern) {
-                $allowWithoutAuth = $allowWithoutAuth || preg_match($pattern, $relativeURL);
-            }
-        }
-
-        // Finally if they weren't allowed to bypass Basic Auth, trigger it
-        if (!$allowWithoutAuth) {
-            $this->callWithSubsitesDisabled(function () {
-                BasicAuth::requireLogin(
-                    $this->owner->getRequest(),
-                    _t(__CLASS__ . '.LoginPrompt', "Please log in with your CMS credentials"),
-                    'ACCESS_UAT_SERVER',
-                    true
-                );
-            });
-        }
-    }
-
-    /**
-     * @return void
-     */
-    public function onBeforeInit()
-    {
-        // Grab global injectable service to allow testing.
-        $director = Injector::inst()->get(Director::class);
-
-        if (Config::inst()->get(__CLASS__, 'ssl_redirection_enabled')) {
-            // redirect some vulnerable areas to the secure domain
-            if (!$director::is_https()) {
-                $forceDomain = Config::inst()->get(__CLASS__, 'ssl_redirection_force_domain');
-
-                if ($forceDomain) {
-                    $director::forceSSL(['/^Security/', '/^api/'], $forceDomain);
-                } else {
-                    $director::forceSSL(['/^Security/', '/^api/']);
-                }
-            }
-        }
-
-        if (Config::inst()->get(__CLASS__, 'test_basicauth_enabled')) {
-            // Turn on Basic Auth in testing mode
-            if ($director::isTest()) {
-                $this->triggerBasicAuthProtection();
-            }
-        }
-
-        if (Config::inst()->get(__CLASS__, 'live_basicauth_enabled')) {
-            // Turn on Basic Auth in live mode
-            if ($director::isLive()) {
-                $this->triggerBasicAuthProtection();
-            }
-        }
-    }
-
-    /**
-     * @return array
-     */
-    public function providePermissions()
-    {
-        return [
-            'ACCESS_UAT_SERVER' => _t(
-                __CLASS__ . '.UatServerPermission',
-                'Allow users to use their accounts to access the UAT server'
-            )
-        ];
-    }
+	/**
+	 * Enables SSL redirections - disabling not recommended as it will prevent forcing SSL on admin panel.
+	 *
+	 * @config
+	 * @var bool
+	 */
+	private static $ssl_redirection_enabled = true;
+
+	/**
+	 * Specify a domain to redirect the vulnerable areas to.
+	 *
+	 * If left as null, live instance will set this to <instance-id>.cwp.govt.nz via CWP_SECURE_DOMAIN in _config.php.
+	 * This allows us to automatically protect vulnerable areas on live even if the frontend cert is not installed.
+	 *
+	 * Set to false to redirect to https protocol on current domain (e.g. if you have frontend cert).
+	 *
+	 * Set to a domain string (e.g. 'example.com') to force that domain.
+	 *
+	 * @config
+	 * @var string
+	 */
+	private static $ssl_redirection_force_domain = null;
+
+	/**
+	 * Enables the BasicAuth protection on all test environments. Disable with caution - it will open up
+	 * all your UAT and test environments to the world.
+	 *
+	 * @config
+	 * @var bool
+	 */
+	private static $test_basicauth_enabled = true;
+
+	/**
+	 * Enables the BasicAuth protection on all live environments.
+	 * Useful for securing sites prior to public launch.
+	 *
+	 * @config
+	 * @var bool
+	 */
+	private static $live_basicauth_enabled = false;
+
+	/**
+	 * This executes the passed callback with subsite filter disabled,
+	 * then enabled the filter again before returning the callback result
+	 * (or throwing the exception the callback raised)
+	 *
+	 * @param  callback  $callback - The callback to execute
+	 * @return mixed     The result of the callback
+	 * @throws Exception Any exception the callback raised
+	 */
+	protected function callWithSubsitesDisabled($callback)
+	{
+		$rv = null;
+
+		try {
+			if (class_exists(Subsite::class)) {
+				Subsite::disable_subsite_filter(true);
+			}
+
+			$rv = call_user_func($callback);
+		} catch (Exception $e) {
+			if (class_exists(Subsite::class)) {
+				Subsite::disable_subsite_filter(false);
+			}
+
+			throw $e;
+		}
+
+		if (class_exists(Subsite::class)) {
+			Subsite::disable_subsite_filter(false);
+		}
+
+		return $rv;
+	}
+
+	/**
+	 * Trigger Basic Auth protection, except when there's a reason to bypass it
+	 *  - The source IP address is in the comma-seperated string in the constant CWP_IP_BYPASS_BASICAUTH
+	 *    (so Pingdom, etc, can access the site)
+	 *  - There is an identifiable member, that member has the ACCESS_UAT_SERVER permission, and they're trying
+	 *    to access a white-list of URLs (so people following a reset password link can reset their password)
+	 */
+	protected function triggerBasicAuthProtection()
+	{
+		$allowWithoutAuth = false;
+
+		// Allow whitelisting IPs for bypassing the basic auth.
+		if (Environment::getEnv('CWP_IP_BYPASS_BASICAUTH')) {
+			$remote = $_SERVER['REMOTE_ADDR'];
+			$bypass = explode(',', Environment::getEnv('CWP_IP_BYPASS_BASICAUTH'));
+
+			if (in_array($remote, $bypass)) {
+				$allowWithoutAuth = true;
+			}
+		}
+
+		// First, see if we can get a member to act on, either from a changepassword token or the session
+		if (isset($_REQUEST['m']) && isset($_REQUEST['t'])) {
+			$member = Member::get()->filter('ID', (int) $_REQUEST['m'])->first();
+
+			if (!$member->validateAutoLoginToken($_REQUEST['t'])) {
+				$member = null;
+			}
+		} elseif ($this->owner->getRequest()->getSession()->get('AutoLoginHash')) {
+			$member = Member::member_from_autologinhash(
+				$this->owner->getRequest()->getSession()->get('AutoLoginHash')
+			);
+		} else {
+			$member = Security::getCurrentUser();
+		}
+
+		// Then, if they have the right permissions, check the allowed URLs
+		$existingMemberCanAccessUAT = $member && $this->callWithSubsitesDisabled(function () use ($member) {
+			return Permission::checkMember($member, 'ACCESS_UAT_SERVER');
+		});
+
+		if ($existingMemberCanAccessUAT) {
+			$allowed = array(
+				'/^Security\/changepassword/',
+				'/^Security\/ChangePasswordForm/'
+			);
+
+			$relativeURL = Director::makeRelative(Director::absoluteURL($_SERVER['REQUEST_URI']));
+
+			foreach ($allowed as $pattern) {
+				$allowWithoutAuth = $allowWithoutAuth || preg_match($pattern, $relativeURL);
+			}
+		}
+
+		// Finally if they weren't allowed to bypass Basic Auth, trigger it
+		if (!$allowWithoutAuth) {
+			$this->callWithSubsitesDisabled(function () {
+				BasicAuth::requireLogin(
+					$this->owner->getRequest(),
+					_t(__CLASS__ . '.LoginPrompt', "Please log in with your CMS credentials"),
+					'ACCESS_UAT_SERVER',
+					true
+				);
+			});
+		}
+	}
+
+	/**
+	 * @return void
+	 */
+	public function onBeforeInit()
+	{
+		// Grab global injectable service to allow testing.
+		$director = Injector::inst()->get(Director::class);
+
+		if (Config::inst()->get(__CLASS__, 'ssl_redirection_enabled')) {
+			// redirect some vulnerable areas to the secure domain
+			if (!$director::is_https()) {
+				$forceDomain = Config::inst()->get(__CLASS__, 'ssl_redirection_force_domain');
+
+				if ($forceDomain) {
+					$director::forceSSL(['/^Security/', '/^api/'], $forceDomain);
+				} else {
+					$director::forceSSL(['/^Security/', '/^api/']);
+				}
+			}
+		}
+
+		if (Config::inst()->get(__CLASS__, 'test_basicauth_enabled')) {
+			// Turn on Basic Auth in testing mode
+			if ($director::isTest()) {
+				$this->triggerBasicAuthProtection();
+			}
+		}
+
+		if (Config::inst()->get(__CLASS__, 'live_basicauth_enabled')) {
+			// Turn on Basic Auth in live mode
+			if ($director::isLive()) {
+				$this->triggerBasicAuthProtection();
+			}
+		}
+	}
+
+	/**
+	 * @return array
+	 */
+	public function providePermissions()
+	{
+		return [
+			'ACCESS_UAT_SERVER' => _t(
+				__CLASS__ . '.UatServerPermission',
+				'Allow users to use their accounts to access the UAT server'
+			)
+		];
+	}
 }

Spacing +3 added lines, -3 removed lines

@@ -116,7 +116,7 @@ 
 
         // First, see if we can get a member to act on, either from a changepassword token or the session
         if (isset($_REQUEST['m']) && isset($_REQUEST['t'])) {
-            $member = Member::get()->filter('ID', (int) $_REQUEST['m'])->first();
+            $member = Member::get()->filter('ID', (int)$_REQUEST['m'])->first();
 
             if (!$member->validateAutoLoginToken($_REQUEST['t'])) {
                 $member = null;
@@ -130,7 +130,7 @@ 
         }
 
         // Then, if they have the right permissions, check the allowed URLs
-        $existingMemberCanAccessUAT = $member && $this->callWithSubsitesDisabled(function () use ($member) {
+        $existingMemberCanAccessUAT = $member && $this->callWithSubsitesDisabled(function() use ($member) {
             return Permission::checkMember($member, 'ACCESS_UAT_SERVER');
         });
 
@@ -149,7 +149,7 @@ 
 
         // Finally if they weren't allowed to bypass Basic Auth, trigger it
         if (!$allowWithoutAuth) {
-            $this->callWithSubsitesDisabled(function () {
+            $this->callWithSubsitesDisabled(function() {
                 BasicAuth::requireLogin(
                     $this->owner->getRequest(),
                     _t(__CLASS__ . '.LoginPrompt', "Please log in with your CMS credentials"),