SecurityTest::testLogout() - Code Metrics - Inspection of "WIP: Add CSRF token to logout action" - silverstripe/silverstripe-framework - Measure and Improve Code Quality continuously with Scrutinizer

Completed
Pull Request — master (#7028)

by Loz
created 2017-06-22 08:03 UTC
SecurityTest::testLogout() A

↳ Parent: SecurityTest
Complexity

Conditions	2
Paths	2
Size

Total Lines	53
Code Lines	27
Duplication

Lines	0
Ratio	0 %
Importance

Changes	1
Bugs	0	Features	0
Metric	Value
cc	2
eloc	27
c	1
b	0
f	0
nc	2
nop	0
dl	0
loc	53
rs	9.5797
How to fix Long Method

<?php

namespace SilverStripe\Security\Tests;

use SilverStripe\Dev\Debug;
use SilverStripe\ORM\DataObject;
use SilverStripe\ORM\FieldType\DBDatetime;
use SilverStripe\ORM\FieldType\DBClassName;
use SilverStripe\ORM\DB;
use SilverStripe\ORM\ValidationResult;
use SilverStripe\Security\LoginAttempt;
use SilverStripe\Security\Member;
use SilverStripe\Security\MemberAuthenticator\MemberAuthenticator;
use SilverStripe\Security\Security;
use SilverStripe\Security\SecurityToken;
use SilverStripe\Core\Config\Config;
use SilverStripe\Core\Convert;
use SilverStripe\Dev\FunctionalTest;
use SilverStripe\Dev\TestOnly;
use SilverStripe\Control\HTTPResponse;
use SilverStripe\Control\Session;
use SilverStripe\Control\Director;
use SilverStripe\Control\Controller;
use SilverStripe\i18n\i18n;

/**
 * Test the security class, including log-in form, change password form, etc
 */
class SecurityTest extends FunctionalTest
{
    protected static $fixture_file = 'MemberTest.yml';

    protected $autoFollowRedirection = false;

    protected static $extra_controllers = [
        SecurityTest\NullController::class,
        SecurityTest\SecuredController::class,
    ];

    protected function setUp()
    {
        // Set to an empty array of authenticators to enable the default
        Config::modify()->set(MemberAuthenticator::class, 'authenticators', []);
        Config::modify()->set(MemberAuthenticator::class, 'default_authenticator', MemberAuthenticator::class);

        /**
         * @skipUpgrade
         */
        Member::config()->unique_identifier_field = 'Email';
<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}

        parent::setUp();

        Config::modify()->merge('SilverStripe\\Control\\Director', 'alternate_base_url', '/');
    }

    public function testAccessingAuthenticatedPageRedirectsToLoginForm()
    {
        $this->autoFollowRedirection = false;

        $response = $this->get('SecurityTest_SecuredController');
        $this->assertEquals(302, $response->getStatusCode());
        $this->assertContains(
            Config::inst()->get(Security::class, 'login_url'),
            $response->getHeader('Location')
        );

        $this->logInWithPermission('ADMIN');
        $response = $this->get('SecurityTest_SecuredController');
        $this->assertEquals(200, $response->getStatusCode());
        $this->assertContains('Success', $response->getBody());

        $this->autoFollowRedirection = true;
    }

    public function testPermissionFailureSetsCorrectFormMessages()
    {
        Config::nest();

        // Controller that doesn't attempt redirections
        $controller = new SecurityTest\NullController();
        $controller->setResponse(new HTTPResponse());

        Security::permissionFailure($controller, array('default' => 'Oops, not allowed'));
        $this->assertEquals('Oops, not allowed', Session::get('Security.Message.message'));

        // Test that config values are used correctly
        Config::inst()->update(Security::class, 'default_message_set', 'stringvalue');
interface User
{
    /** @return string */
    public function getPassword();
}

class MyUser implements User
{
    public function getPassword()
    {
        // return something
    }

    public function getDisplayName()
    {
        // return some name.
    }
}

class AuthSystem
{
    public function authenticate(User $user)
    {
        $this->logger->info(sprintf('Authenticating %s.', $user->getDisplayName()));
        // do something.
    }
}
        Security::permissionFailure($controller);
        $this->assertEquals(
            'stringvalue',
            Session::get('Security.Message.message'),
            'Default permission failure message value was not present'
        );

        Config::modify()->remove(Security::class, 'default_message_set');
        Config::modify()->merge(Security::class, 'default_message_set', array('default' => 'arrayvalue'));
        Security::permissionFailure($controller);
        $this->assertEquals(
            'arrayvalue',
            Session::get('Security.Message.message'),
            'Default permission failure message value was not present'
        );

        // Test that non-default messages work.
        // NOTE: we inspect the response body here as the session message has already
        // been fetched and output as part of it, so has been removed from the session
        $this->logInWithPermission('EDITOR');

        Config::inst()->update(
interface User
{
    /** @return string */
    public function getPassword();
}

class MyUser implements User
{
    public function getPassword()
    {
        // return something
    }

    public function getDisplayName()
    {
        // return some name.
    }
}

class AuthSystem
{
    public function authenticate(User $user)
    {
        $this->logger->info(sprintf('Authenticating %s.', $user->getDisplayName()));
        // do something.
    }
}
            Security::class,
            'default_message_set',
            array('default' => 'default', 'alreadyLoggedIn' => 'You are already logged in!')
        );
        Security::permissionFailure($controller);
        $this->assertContains(
            'You are already logged in!',
            $controller->getResponse()->getBody(),
            'Custom permission failure message was ignored'
        );

        Security::permissionFailure(
            $controller,
            array('default' => 'default', 'alreadyLoggedIn' => 'One-off failure message')
        );
        $this->assertContains(
            'One-off failure message',
            $controller->getResponse()->getBody(),
            "Message set passed to Security::permissionFailure() didn't override Config values"
        );

        Config::unnest();
    }

    /**
     * Follow all redirects recursively
     *
     * @param  string $url
     * @param  int    $limit Max number of requests
     * @return HTTPResponse
     */
    protected function getRecursive($url, $limit = 10)
    {
        $this->cssParser = null;
        $response = $this->mainSession->get($url);
        while (--$limit > 0 && $response instanceof HTTPResponse && $response->getHeader('Location')) {
            $response = $this->mainSession->followRedirection();
        }
        return $response;
    }

    public function testAutomaticRedirectionOnLogin()
    {
        // BackURL with permission error (not authenticated) should not redirect
        if ($member = Security::getCurrentUser()) {
            Security::setCurrentUser(null);
        }
        $response = $this->getRecursive('SecurityTest_SecuredController');
        $this->assertContains(Convert::raw2xml("That page is secured."), $response->getBody());
        $this->assertContains('<input type="submit" name="action_doLogin"', $response->getBody());

        // Non-logged in user should not be redirected, but instead shown the login form
        // No message/context is available as the user has not attempted to view the secured controller
        $response = $this->getRecursive('Security/login?BackURL=SecurityTest_SecuredController/');
        $this->assertNotContains(Convert::raw2xml("That page is secured."), $response->getBody());
        $this->assertNotContains(Convert::raw2xml("You don't have access to this page"), $response->getBody());
        $this->assertContains('<input type="submit" name="action_doLogin"', $response->getBody());

        // BackURL with permission error (wrong permissions) should not redirect
        $this->logInAs('grouplessmember');
        $response = $this->getRecursive('SecurityTest_SecuredController');
        $this->assertContains(Convert::raw2xml("You don't have access to this page"), $response->getBody());
        $this->assertContains(
            '<input type="submit" name="action_logout" value="Log in as someone else"',
            $response->getBody()
        );

        // Directly accessing this page should attempt to follow the BackURL, but stop when it encounters the error
        $response = $this->getRecursive('Security/login?BackURL=SecurityTest_SecuredController/');
        $this->assertContains(Convert::raw2xml("You don't have access to this page"), $response->getBody());
        $this->assertContains(
            '<input type="submit" name="action_logout" value="Log in as someone else"',
            $response->getBody()
        );

        // Check correctly logged in admin doesn't generate the same errors
        $this->logInAs('admin');
        $response = $this->getRecursive('SecurityTest_SecuredController');
        $this->assertContains(Convert::raw2xml("Success"), $response->getBody());

        // Directly accessing this page should attempt to follow the BackURL and succeed
        $response = $this->getRecursive('Security/login?BackURL=SecurityTest_SecuredController/');
        $this->assertContains(Convert::raw2xml("Success"), $response->getBody());
    }

    public function testLogInAsSomeoneElse()
    {
        $member = DataObject::get_one(Member::class);

        /* Log in with any user that we can find */
        Security::setCurrentUser($member);

        /* View the Security/login page */
        $response = $this->get(Config::inst()->get(Security::class, 'login_url'));

        $items = $this->cssParser()->getBySelector('#MemberLoginForm_LoginForm input.action');

        /* We have only 1 input, one to allow the user to log in as someone else */
        $this->assertEquals(count($items), 1, 'There is 1 input, allowing the user to log in as someone else.');

        $this->autoFollowRedirection = true;

        /* Submit the form, using only the logout action and a hidden field for the authenticator */
        $response = $this->submitForm(
            'MemberLoginForm_LoginForm',
            null,
            array(
                'action_logout' => 1,
            )
        );

        /* We get a good response */
        $this->assertEquals($response->getStatusCode(), 200, 'We have a 200 OK response');
        $this->assertNotNull($response->getBody(), 'There is body content on the page');

        /* Log the user out */
        Security::setCurrentUser(null);
    }

    public function testMemberIDInSessionDoesntExistInDatabaseHasToLogin()
    {
        /* Log in with a Member ID that doesn't exist in the DB */
        $this->session()->inst_set('loggedInAs', 500);

        $this->autoFollowRedirection = true;

        /* Attempt to get into the admin section */
        $response = $this->get(Config::inst()->get(Security::class, 'login_url'));

        $items = $this->cssParser()->getBySelector('#MemberLoginForm_LoginForm input.text');

        /* We have 2 text inputs - one for email, and another for the password */
        $this->assertEquals(count($items), 2, 'There are 2 inputs - one for email, another for password');

        $this->autoFollowRedirection = false;

        /* Log the user out */
        $this->session()->inst_set('loggedInAs', null);
    }

    public function testLoginUsernamePersists()
    {
        // Test that username does not persist
        $this->session()->inst_set('SessionForms.MemberLoginForm.Email', '[email protected]');
        Security::config()->remember_username = false;
<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}
        $this->get(Config::inst()->get(Security::class, 'login_url'));
        $items = $this
            ->cssParser()
            ->getBySelector('#MemberLoginForm_LoginForm #MemberLoginForm_LoginForm_Email');
        $this->assertEquals(1, count($items));
        $this->assertEmpty((string)$items[0]->attributes()->value);
        $this->assertEquals('off', (string)$items[0]->attributes()->autocomplete);
        $form = $this->cssParser()->getBySelector('#MemberLoginForm_LoginForm');
        $this->assertEquals(1, count($form));
        $this->assertEquals('off', (string)$form[0]->attributes()->autocomplete);

        // Test that username does persist when necessary
        $this->session()->inst_set('SessionForms.MemberLoginForm.Email', '[email protected]');
        Security::config()->remember_username = true;
<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}
        $this->get(Config::inst()->get(Security::class, 'login_url'));
        $items = $this
            ->cssParser()
            ->getBySelector('#MemberLoginForm_LoginForm #MemberLoginForm_LoginForm_Email');
        $this->assertEquals(1, count($items));
        $this->assertEquals('[email protected]', (string)$items[0]->attributes()->value);
        $this->assertNotEquals('off', (string)$items[0]->attributes()->autocomplete);
        $form = $this->cssParser()->getBySelector('#MemberLoginForm_LoginForm');
        $this->assertEquals(1, count($form));
        $this->assertNotEquals('off', (string)$form[0]->attributes()->autocomplete);
    }

    public function testLogout()
    {
        /* Enable SecurityToken */
        $securityTokenWasEnabled = SecurityToken::is_enabled();
        SecurityToken::enable();

        $member = DataObject::get_one(Member::class);

        /* Log in with any user that we can find */
        Security::setCurrentUser($member);

        /* Visit the Security/logout page with a test referer, but without a security token */
        $response = $this->get(
            Config::inst()->get(Security::class, 'logout_url'),
            null,
            ['Referer' => Director::absoluteBaseURL() . 'testpage']
        );

        /* Make sure the user is still logged in */
        $this->assertNotNull(Security::getCurrentUser(), 'User is still logged in.');

        $token = $this->cssParser()->getBySelector('#LogoutForm_Form #LogoutForm_Form_SecurityID');
        $actions = $this->cssParser()->getBySelector('#LogoutForm_Form input.action');

        /* We have a security token, and an action to allow the user to log out */
        $this->assertCount(1, $token, 'There is a hidden field containing a security token.');
        $this->assertCount(1, $actions, 'There is 1 action, allowing the user to log out.');

        /* Submit the form, using the logout action */
        $response = $this->submitForm(
            'LogoutForm_Form',
            null,
            array(
                'action_doLogout' => 1,
            )
        );

        /* We get a good response */
        $this->assertEquals(302, $response->getStatusCode());
        $this->assertRegExp(
            '/testpage/',
            $response->getHeader('Location'),
            "Logout form redirects to back to referer."
        );

        /* User is logged out successfully */
        $this->assertNull(Security::getCurrentUser(), 'User is logged out.');

        /* Re-disable SecurityToken */
        if (!$securityTokenWasEnabled) {
            SecurityToken::disable();
        }
    }

    public function testExternalBackUrlRedirectionDisallowed()
    {
        // Test internal relative redirect
        $response = $this->doTestLoginForm('[email protected]', '1nitialPassword', 'testpage');
        $this->assertEquals(302, $response->getStatusCode());
        $this->assertRegExp(
            '/testpage/',
            $response->getHeader('Location'),
            "Internal relative BackURLs work when passed through to login form"
        );
        // Log the user out
        $this->session()->inst_set('loggedInAs', null);

        // Test internal absolute redirect
        $response = $this->doTestLoginForm(
            '[email protected]',
            '1nitialPassword',
            Director::absoluteBaseURL() . 'testpage'
        );
        // for some reason the redirect happens to a relative URL
        $this->assertRegExp(
            '/^' . preg_quote(Director::absoluteBaseURL(), '/') . 'testpage/',
            $response->getHeader('Location'),
            "Internal absolute BackURLs work when passed through to login form"
        );
        // Log the user out
        $this->session()->inst_set('loggedInAs', null);

        // Test external redirect
        $response = $this->doTestLoginForm('[email protected]', '1nitialPassword', 'http://myspoofedhost.com');
        $this->assertNotRegExp(
            '/^' . preg_quote('http://myspoofedhost.com', '/') . '/',
            (string)$response->getHeader('Location'),
            "Redirection to external links in login form BackURL gets prevented as a measure against spoofing attacks"
        );

        // Test external redirection on ChangePasswordForm
        $this->get('Security/changepassword?BackURL=http://myspoofedhost.com');
        $changedResponse = $this->doTestChangepasswordForm('1nitialPassword', 'changedPassword');
        $this->assertNotRegExp(
            '/^' . preg_quote('http://myspoofedhost.com', '/') . '/',
            (string)$changedResponse->getHeader('Location'),
            "Redirection to external links in change password form BackURL gets prevented to stop spoofing attacks"
        );

        // Log the user out
        $this->session()->inst_set('loggedInAs', null);
    }

    /**
     * Test that the login form redirects to the change password form after logging in with an expired password
     */
    public function testExpiredPassword()
    {
        /* BAD PASSWORDS ARE LOCKED OUT */
        $badResponse = $this->doTestLoginForm('[email protected]', 'badpassword');
        $this->assertEquals(302, $badResponse->getStatusCode());
        $this->assertRegExp('/Security\/login/', $badResponse->getHeader('Location'));
        $this->assertNull($this->session()->inst_get('loggedInAs'));

        /* UNEXPIRED PASSWORD GO THROUGH WITHOUT A HITCH */
        $goodResponse = $this->doTestLoginForm('[email protected]', '1nitialPassword');
        $this->assertEquals(302, $goodResponse->getStatusCode());
        $this->assertEquals(
            Controller::join_links(Director::absoluteBaseURL(), 'test/link'),
            $goodResponse->getHeader('Location')
        );
        $this->assertEquals($this->idFromFixture(Member::class, 'test'), $this->session()->inst_get('loggedInAs'));

        $this->logOut();

        /* EXPIRED PASSWORDS ARE SENT TO THE CHANGE PASSWORD FORM */
        $expiredResponse = $this->doTestLoginForm('[email protected]', '1nitialPassword');
        $this->assertEquals(302, $expiredResponse->getStatusCode());
        $this->assertEquals(
            Director::absoluteURL('Security/changepassword').'?BackURL=test%2Flink',
            Director::absoluteURL($expiredResponse->getHeader('Location'))
        );
        $this->assertEquals(
            $this->idFromFixture(Member::class, 'expiredpassword'),
            $this->session()->inst_get('loggedInAs')
        );

        // Make sure it redirects correctly after the password has been changed
        $this->mainSession->followRedirection();
        $changedResponse = $this->doTestChangepasswordForm('1nitialPassword', 'changedPassword');
        $this->assertEquals(302, $changedResponse->getStatusCode());
        $this->assertEquals(
            Controller::join_links(Director::absoluteBaseURL(), 'test/link'),
            $changedResponse->getHeader('Location')
        );
    }

    public function testChangePasswordForLoggedInUsers()
    {
        $goodResponse = $this->doTestLoginForm('[email protected]', '1nitialPassword');

        // Change the password
        $this->get('Security/changepassword?BackURL=test/back');
        $changedResponse = $this->doTestChangepasswordForm('1nitialPassword', 'changedPassword');
        $this->assertEquals(302, $changedResponse->getStatusCode());
        $this->assertEquals(
            Controller::join_links(Director::absoluteBaseURL(), 'test/back'),
            $changedResponse->getHeader('Location')
        );
        $this->assertEquals($this->idFromFixture(Member::class, 'test'), $this->session()->inst_get('loggedInAs'));

        // Check if we can login with the new password
        $this->logOut();
        $goodResponse = $this->doTestLoginForm('[email protected]', 'changedPassword');
        $this->assertEquals(302, $goodResponse->getStatusCode());
        $this->assertEquals(
            Controller::join_links(Director::absoluteBaseURL(), 'test/link'),
            $goodResponse->getHeader('Location')
        );
        $this->assertEquals($this->idFromFixture(Member::class, 'test'), $this->session()->inst_get('loggedInAs'));
    }

    public function testChangePasswordFromLostPassword()
    {
        $admin = $this->objFromFixture(Member::class, 'test');
        $admin->FailedLoginCount = 99;
<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}
        $admin->LockedOutUntil = DBDatetime::now()->getValue();
<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}
        $admin->write();

        $this->assertNull($admin->AutoLoginHash, 'Hash is empty before lost password');

        // Request new password by email
        $response = $this->get('Security/lostpassword');
        $response = $this->post('Security/lostpassword/LostPasswordForm', array('Email' => '[email protected]'));

        $this->assertEmailSent('[email protected]');

        // Load password link from email
        $admin = DataObject::get_by_id(Member::class, $admin->ID);
        $this->assertNotNull($admin->AutoLoginHash, 'Hash has been written after lost password');

        // We don't have access to the token - generate a new token and hash pair.
        $token = $admin->generateAutologinTokenAndStoreHash();

        // Check.
        $response = $this->get('Security/changepassword/?m='.$admin->ID.'&t=' . $token);
        $this->assertEquals(302, $response->getStatusCode());
        $this->assertEquals(
            Director::absoluteURL('Security/changepassword'),
            Director::absoluteURL($response->getHeader('Location'))
        );

        // Follow redirection to form without hash in GET parameter
        $response = $this->get('Security/changepassword');
        $changedResponse = $this->doTestChangepasswordForm('1nitialPassword', 'changedPassword');
        $this->assertEquals($this->idFromFixture(Member::class, 'test'), $this->session()->inst_get('loggedInAs'));

        // Check if we can login with the new password
        $this->logOut();
        $goodResponse = $this->doTestLoginForm('[email protected]', 'changedPassword');
        $this->assertEquals(302, $goodResponse->getStatusCode());
        $this->assertEquals($this->idFromFixture(Member::class, 'test'), $this->session()->inst_get('loggedInAs'));

        $admin = DataObject::get_by_id(Member::class, $admin->ID, false);
        $this->assertNull($admin->LockedOutUntil);
        $this->assertEquals(0, $admin->FailedLoginCount);
    }

    public function testRepeatedLoginAttemptsLockingPeopleOut()
    {
        $local = i18n::get_locale();
        i18n::set_locale('en_US');

        Member::config()->lock_out_after_incorrect_logins = 5;
<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}
        Member::config()->lock_out_delay_mins = 15;
<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}

        // Login with a wrong password for more than the defined threshold
        for ($i = 1; $i <= (Member::config()->lock_out_after_incorrect_logins+1); $i++) {
            $this->doTestLoginForm('[email protected]', 'incorrectpassword');
            $member = DataObject::get_by_id(Member::class, $this->idFromFixture(Member::class, 'test'));

            if ($i < Member::config()->get('lock_out_after_incorrect_logins')) {
                $this->assertNull(
                    $member->LockedOutUntil,
                    'User does not have a lockout time set if under threshold for failed attempts'
                );
                $this->assertHasMessage(
                    _t(
                        'SilverStripe\\Security\\Member.ERRORWRONGCRED',
                        'The provided details don\'t seem to be correct. Please try again.'
                    )
                );
            } else {
                // Fuzzy matching for time to avoid side effects from slow running tests
                $this->assertGreaterThan(
                    time() + 14*60,
                    strtotime($member->LockedOutUntil),
                    'User has a lockout time set after too many failed attempts'
                );
            }
        }
        $msg = _t(
            'SilverStripe\\Security\\Member.ERRORLOCKEDOUT2',
            'Your account has been temporarily disabled because of too many failed attempts at ' .
            'logging in. Please try again in {count} minutes.',
            null,
            array('count' => Member::config()->lock_out_delay_mins)
        );
        $this->assertHasMessage($msg);


        $this->doTestLoginForm('[email protected]', '1nitialPassword');
        $this->assertNull(
            $this->session()->inst_get('loggedInAs'),
            'The user can\'t log in after being locked out, even with the right password'
        );

        // (We fake this by re-setting LockedOutUntil)
        $member = DataObject::get_by_id(Member::class, $this->idFromFixture(Member::class, 'test'));
        $member->LockedOutUntil = date('Y-m-d H:i:s', time() - 30);
<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}
        $member->write();
        $this->doTestLoginForm('[email protected]', '1nitialPassword');
        $this->assertEquals(
            $this->session()->inst_get('loggedInAs'),
            $member->ID,
            'After lockout expires, the user can login again'
        );

        // Log the user out
        $this->logOut();

        // Login again with wrong password, but less attempts than threshold
        for ($i = 1; $i < Member::config()->lock_out_after_incorrect_logins; $i++) {
            $this->doTestLoginForm('[email protected]', 'incorrectpassword');
        }
        $this->assertNull($this->session()->inst_get('loggedInAs'));
        $this->assertHasMessage(
            _t('SilverStripe\\Security\\Member.ERRORWRONGCRED', 'The provided details don\'t seem to be correct. Please try again.'),
            'The user can retry with a wrong password after the lockout expires'
        );

        $this->doTestLoginForm('[email protected]', '1nitialPassword');
        $this->assertEquals(
            $this->session()->inst_get('loggedInAs'),
            $member->ID,
            'The user can login successfully after lockout expires, if staying below the threshold'
        );

        i18n::set_locale($local);
    }

    public function testAlternatingRepeatedLoginAttempts()
    {
        Member::config()->lock_out_after_incorrect_logins = 3;
<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}

        // ATTEMPTING LOG-IN TWICE WITH ONE ACCOUNT AND TWICE WITH ANOTHER SHOULDN'T LOCK ANYBODY OUT

        $this->doTestLoginForm('[email protected]', 'incorrectpassword');
        $this->doTestLoginForm('[email protected]', 'incorrectpassword');

        $this->doTestLoginForm('[email protected]', 'incorrectpassword');
        $this->doTestLoginForm('[email protected]', 'incorrectpassword');

        $member1 = DataObject::get_by_id(Member::class, $this->idFromFixture(Member::class, 'test'));
        $member2 = DataObject::get_by_id(Member::class, $this->idFromFixture(Member::class, 'noexpiry'));

        $this->assertNull($member1->LockedOutUntil);
        $this->assertNull($member2->LockedOutUntil);

        // BUT, DOING AN ADDITIONAL LOG-IN WITH EITHER OF THEM WILL LOCK OUT, SINCE THAT IS THE 3RD FAILURE IN
        // THIS SESSION

        $this->doTestLoginForm('[email protected]', 'incorrectpassword');
        $member1 = DataObject::get_by_id(Member::class, $this->idFromFixture(Member::class, 'test'));
        $this->assertNotNull($member1->LockedOutUntil);

        $this->doTestLoginForm('[email protected]', 'incorrectpassword');
        $member2 = DataObject::get_by_id(Member::class, $this->idFromFixture(Member::class, 'noexpiry'));
        $this->assertNotNull($member2->LockedOutUntil);
    }

    public function testUnsuccessfulLoginAttempts()
    {
        Security::config()->login_recording = true;
<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}

        /* UNSUCCESSFUL ATTEMPTS WITH WRONG PASSWORD FOR EXISTING USER ARE LOGGED */
        $this->doTestLoginForm('[email protected]', 'wrongpassword');
        $attempt = DataObject::get_one(
            LoginAttempt::class,
            array(
                '"LoginAttempt"."Email"' => '[email protected]'
            )
        );
        $this->assertTrue(is_object($attempt));
        $member = DataObject::get_one(
            Member::class,
            array(
                '"Member"."Email"' => '[email protected]'
            )
        );
        $this->assertEquals($attempt->Status, 'Failure');
        $this->assertEquals($attempt->Email, '[email protected]');
        $this->assertEquals($attempt->Member()->toMap(), $member->toMap());

        /* UNSUCCESSFUL ATTEMPTS WITH NONEXISTING USER ARE LOGGED */
        $this->doTestLoginForm('[email protected]', 'wrongpassword');
        $attempt = DataObject::get_one(
            LoginAttempt::class,
            array(
            '"LoginAttempt"."Email"' => '[email protected]'
            )
        );
        $this->assertTrue(is_object($attempt));
        $this->assertEquals($attempt->Status, 'Failure');
        $this->assertEquals($attempt->Email, '[email protected]');
        $this->assertNotEmpty($this->getValidationResult()->getMessages(), 'An invalid email returns a message.');
    }

    public function testSuccessfulLoginAttempts()
    {
        Security::config()->login_recording = true;
<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}

        /* SUCCESSFUL ATTEMPTS ARE LOGGED */
        $this->doTestLoginForm('[email protected]', '1nitialPassword');
        $attempt = DataObject::get_one(
            LoginAttempt::class,
            array(
            '"LoginAttempt"."Email"' => '[email protected]'
            )
        );
        $member = DataObject::get_one(
            Member::class,
            array(
            '"Member"."Email"' => '[email protected]'
            )
        );
        $this->assertTrue(is_object($attempt));
        $this->assertEquals($attempt->Status, 'Success');
        $this->assertEquals($attempt->Email, '[email protected]');
        $this->assertEquals($attempt->Member()->toMap(), $member->toMap());
    }

    public function testDatabaseIsReadyWithInsufficientMemberColumns()
    {
        Security::clear_database_is_ready();
        DBClassName::clear_classname_cache();

        // Assumption: The database has been built correctly by the test runner,
        // and has all columns present in the ORM
        /**
         * @skipUpgrade
         */
        DB::get_schema()->renameField('Member', 'Email', 'Email_renamed');

        // Email column is now missing, which means we're not ready to do permission checks
        $this->assertFalse(Security::database_is_ready());

        // Rebuild the database (which re-adds the Email column), and try again
        static::resetDBSchema(true);
        $this->assertTrue(Security::database_is_ready());
    }

    public function testSecurityControllerSendsRobotsTagHeader()
    {
        $response = $this->get(Config::inst()->get(Security::class, 'login_url'));
        $robotsHeader = $response->getHeader('X-Robots-Tag');
        $this->assertNotNull($robotsHeader);
        $this->assertContains('noindex', $robotsHeader);
    }

    public function testDoNotSendEmptyRobotsHeaderIfNotDefined()
    {
        Config::inst()->remove(Security::class, 'robots_tag');
interface User
{
    /** @return string */
    public function getPassword();
}

class MyUser implements User
{
    public function getPassword()
    {
        // return something
    }

    public function getDisplayName()
    {
        // return some name.
    }
}

class AuthSystem
{
    public function authenticate(User $user)
    {
        $this->logger->info(sprintf('Authenticating %s.', $user->getDisplayName()));
        // do something.
    }
}
        $response = $this->get(Config::inst()->get(Security::class, 'login_url'));
        $robotsHeader = $response->getHeader('X-Robots-Tag');
        $this->assertNull($robotsHeader);
    }

    /**
     * Execute a log-in form using Director::test().
     * Helper method for the tests above
     */
    public function doTestLoginForm($email, $password, $backURL = 'test/link')
    {
        $this->get(Config::inst()->get(Security::class, 'logout_url'));
        $this->session()->inst_set('BackURL', $backURL);
        $this->get(Config::inst()->get(Security::class, 'login_url'));

        return $this->submitForm(
            "MemberLoginForm_LoginForm",
            null,
            array(
                'Email' => $email,
                'Password' => $password,
                'AuthenticationMethod' => MemberAuthenticator::class,
                'action_doLogin' => 1,
            )
        );
    }

    /**
     * Helper method to execute a change password form
     */
    public function doTestChangepasswordForm($oldPassword, $newPassword)
    {
        return $this->submitForm(
            "ChangePasswordForm_ChangePasswordForm",
            null,
            array(
                'OldPassword' => $oldPassword,
                'NewPassword1' => $newPassword,
                'NewPassword2' => $newPassword,
                'action_doChangePassword' => 1,
            )
        );
    }

    /**
     * Assert this message is in the current login form errors
     *
     * @param string $expected
     * @param string $errorMessage
     */
    protected function assertHasMessage($expected, $errorMessage = null)
    {
        $messages = [];
        $result = $this->getValidationResult();
        if ($result) {
            foreach ($result->getMessages() as $message) {
                $messages[] = $message['message'];
            }
        }

        $this->assertContains($expected, $messages, $errorMessage);
    }

    /**
     * Get validation result from last login form submission
     *
     * @return ValidationResult
     */
    protected function getValidationResult()
    {
        $result = $this->session()->inst_get('FormInfo.MemberLoginForm_LoginForm.result');
        if ($result) {
            return unserialize($result);
        }
        return null;
    }
}

Pull Request — master (#7028)

SecurityTest::testLogout() A

Complexity

Size

Duplication

Importance

How to fix Long Method

Long Method

Available Fixes

Available Fixes

Available Fixes

silverstripe / silverstripe-framework

Pull Request — master (#7028)

SecurityTest::testLogout() A

Complexity

Size

Duplication

Importance

How to fix Long Method

Long Method

Available Fixes

Available Fixes

Available Fixes

Duplication Side-by-Side

Filter issues like
