define( 'NS_UNITTEST', 5600 );
define( 'NS_UNITTEST_TALK', 5601 );
+use MediaWiki\MediaWikiServices;
+
/**
* @group Database
*/
$this->setUpPermissionGlobals();
$this->user = new User;
+ $this->user->addToDatabase();
$this->user->addGroup( 'unittesters' );
}
*/
public function testUserGetRightsHooks() {
$user = new User;
+ $user->addToDatabase();
$user->addGroup( 'unittesters' );
$user->addGroup( 'testwriters' );
$userWrapper = TestingAccessWrapper::newFromObject( $user );
$user = $this->getMutableTestUser()->getUser();
$user->setOption( 'userjs-someoption', 'test' );
- $user->setOption( 'cols', 200 );
+ $user->setOption( 'rclimit', 200 );
$user->saveSettings();
$user = User::newFromName( $user->getName() );
+ $user->load( User::READ_LATEST );
+ $this->assertEquals( 'test', $user->getOption( 'userjs-someoption' ) );
+ $this->assertEquals( 200, $user->getOption( 'rclimit' ) );
+
+ $user = User::newFromName( $user->getName() );
+ MediaWikiServices::getInstance()->getMainWANObjectCache()->clearProcessCache();
$this->assertEquals( 'test', $user->getOption( 'userjs-someoption' ) );
- $this->assertEquals( 200, $user->getOption( 'cols' ) );
+ $this->assertEquals( 200, $user->getOption( 'rclimit' ) );
}
/**
- * Bug 37963
+ * T39963
* Make sure defaults are loaded when setOption is called.
* @covers User::loadOptions
*/
public function testAnonOptions() {
global $wgDefaultUserOptions;
$this->user->setOption( 'userjs-someoption', 'test' );
- $this->assertEquals( $wgDefaultUserOptions['cols'], $this->user->getOption( 'cols' ) );
+ $this->assertEquals( $wgDefaultUserOptions['rclimit'], $this->user->getOption( 'rclimit' ) );
$this->assertEquals( 'test', $this->user->getOption( 'userjs-someoption' ) );
}
$users->rewind();
$this->assertTrue( $user->equals( $users->current() ) );
}
+
+ /**
+ * When a user is autoblocked a cookie is set with which to track them
+ * in case they log out and change IP addresses.
+ * @link https://phabricator.wikimedia.org/T5233
+ */
+ public function testAutoblockCookies() {
+ // Set up the bits of global configuration that we use.
+ $this->setMwGlobals( [
+ 'wgCookieSetOnAutoblock' => true,
+ 'wgCookiePrefix' => 'wmsitetitle',
+ 'wgSecretKey' => MWCryptRand::generateHex( 64, true ),
+ ] );
+
+ // 1. Log in a test user, and block them.
+ $user1tmp = $this->getTestUser()->getUser();
+ $request1 = new FauxRequest();
+ $request1->getSession()->setUser( $user1tmp );
+ $expiryFiveHours = wfTimestamp() + ( 5 * 60 * 60 );
+ $block = new Block( [
+ 'enableAutoblock' => true,
+ 'expiry' => wfTimestamp( TS_MW, $expiryFiveHours ),
+ ] );
+ $block->setTarget( $user1tmp );
+ $block->insert();
+ $user1 = User::newFromSession( $request1 );
+ $user1->mBlock = $block;
+ $user1->load();
+
+ // Confirm that the block has been applied as required.
+ $this->assertTrue( $user1->isLoggedIn() );
+ $this->assertTrue( $user1->isBlocked() );
+ $this->assertEquals( Block::TYPE_USER, $block->getType() );
+ $this->assertTrue( $block->isAutoblocking() );
+ $this->assertGreaterThanOrEqual( 1, $block->getId() );
+
+ // Test for the desired cookie name, value, and expiry.
+ $cookies = $request1->response()->getCookies();
+ $this->assertArrayHasKey( 'wmsitetitleBlockID', $cookies );
+ $this->assertEquals( $expiryFiveHours, $cookies['wmsitetitleBlockID']['expire'] );
+ $cookieValue = Block::getIdFromCookieValue( $cookies['wmsitetitleBlockID']['value'] );
+ $this->assertEquals( $block->getId(), $cookieValue );
+
+ // 2. Create a new request, set the cookies, and see if the (anon) user is blocked.
+ $request2 = new FauxRequest();
+ $request2->setCookie( 'BlockID', $block->getCookieValue() );
+ $user2 = User::newFromSession( $request2 );
+ $user2->load();
+ $this->assertNotEquals( $user1->getId(), $user2->getId() );
+ $this->assertNotEquals( $user1->getToken(), $user2->getToken() );
+ $this->assertTrue( $user2->isAnon() );
+ $this->assertFalse( $user2->isLoggedIn() );
+ $this->assertTrue( $user2->isBlocked() );
+ $this->assertEquals( true, $user2->getBlock()->isAutoblocking() ); // Non-strict type-check.
+ // Can't directly compare the objects becuase of member type differences.
+ // One day this will work: $this->assertEquals( $block, $user2->getBlock() );
+ $this->assertEquals( $block->getId(), $user2->getBlock()->getId() );
+ $this->assertEquals( $block->getExpiry(), $user2->getBlock()->getExpiry() );
+
+ // 3. Finally, set up a request as a new user, and the block should still be applied.
+ $user3tmp = $this->getTestUser()->getUser();
+ $request3 = new FauxRequest();
+ $request3->getSession()->setUser( $user3tmp );
+ $request3->setCookie( 'BlockID', $block->getId() );
+ $user3 = User::newFromSession( $request3 );
+ $user3->load();
+ $this->assertTrue( $user3->isLoggedIn() );
+ $this->assertTrue( $user3->isBlocked() );
+ $this->assertEquals( true, $user3->getBlock()->isAutoblocking() ); // Non-strict type-check.
+
+ // Clean up.
+ $block->delete();
+ }
+
+ /**
+ * Make sure that no cookie is set to track autoblocked users
+ * when $wgCookieSetOnAutoblock is false.
+ */
+ public function testAutoblockCookiesDisabled() {
+ // Set up the bits of global configuration that we use.
+ $this->setMwGlobals( [
+ 'wgCookieSetOnAutoblock' => false,
+ 'wgCookiePrefix' => 'wm_no_cookies',
+ 'wgSecretKey' => MWCryptRand::generateHex( 64, true ),
+ ] );
+
+ // 1. Log in a test user, and block them.
+ $testUser = $this->getTestUser()->getUser();
+ $request1 = new FauxRequest();
+ $request1->getSession()->setUser( $testUser );
+ $block = new Block( [ 'enableAutoblock' => true ] );
+ $block->setTarget( $testUser );
+ $block->insert();
+ $user = User::newFromSession( $request1 );
+ $user->mBlock = $block;
+ $user->load();
+
+ // 2. Test that the cookie IS NOT present.
+ $this->assertTrue( $user->isLoggedIn() );
+ $this->assertTrue( $user->isBlocked() );
+ $this->assertEquals( Block::TYPE_USER, $block->getType() );
+ $this->assertTrue( $block->isAutoblocking() );
+ $this->assertGreaterThanOrEqual( 1, $user->getBlockId() );
+ $this->assertGreaterThanOrEqual( $block->getId(), $user->getBlockId() );
+ $cookies = $request1->response()->getCookies();
+ $this->assertArrayNotHasKey( 'wm_no_cookiesBlockID', $cookies );
+
+ // Clean up.
+ $block->delete();
+ }
+
+ /**
+ * When a user is autoblocked and a cookie is set to track them, the expiry time of the cookie
+ * should match the block's expiry, to a maximum of 24 hours. If the expiry time is changed,
+ * the cookie's should change with it.
+ */
+ public function testAutoblockCookieInfiniteExpiry() {
+ $this->setMwGlobals( [
+ 'wgCookieSetOnAutoblock' => true,
+ 'wgCookiePrefix' => 'wm_infinite_block',
+ 'wgSecretKey' => MWCryptRand::generateHex( 64, true ),
+ ] );
+ // 1. Log in a test user, and block them indefinitely.
+ $user1Tmp = $this->getTestUser()->getUser();
+ $request1 = new FauxRequest();
+ $request1->getSession()->setUser( $user1Tmp );
+ $block = new Block( [ 'enableAutoblock' => true, 'expiry' => 'infinity' ] );
+ $block->setTarget( $user1Tmp );
+ $block->insert();
+ $user1 = User::newFromSession( $request1 );
+ $user1->mBlock = $block;
+ $user1->load();
+
+ // 2. Test the cookie's expiry timestamp.
+ $this->assertTrue( $user1->isLoggedIn() );
+ $this->assertTrue( $user1->isBlocked() );
+ $this->assertEquals( Block::TYPE_USER, $block->getType() );
+ $this->assertTrue( $block->isAutoblocking() );
+ $this->assertGreaterThanOrEqual( 1, $user1->getBlockId() );
+ $cookies = $request1->response()->getCookies();
+ // Test the cookie's expiry to the nearest minute.
+ $this->assertArrayHasKey( 'wm_infinite_blockBlockID', $cookies );
+ $expOneDay = wfTimestamp() + ( 24 * 60 * 60 );
+ // Check for expiry dates in a 10-second window, to account for slow testing.
+ $this->assertEquals(
+ $expOneDay,
+ $cookies['wm_infinite_blockBlockID']['expire'],
+ 'Expiry date',
+ 5.0
+ );
+
+ // 3. Change the block's expiry (to 2 hours), and the cookie's should be changed also.
+ $newExpiry = wfTimestamp() + 2 * 60 * 60;
+ $block->mExpiry = wfTimestamp( TS_MW, $newExpiry );
+ $block->update();
+ $user2tmp = $this->getTestUser()->getUser();
+ $request2 = new FauxRequest();
+ $request2->getSession()->setUser( $user2tmp );
+ $user2 = User::newFromSession( $request2 );
+ $user2->mBlock = $block;
+ $user2->load();
+ $cookies = $request2->response()->getCookies();
+ $this->assertEquals( wfTimestamp( TS_MW, $newExpiry ), $block->getExpiry() );
+ $this->assertEquals( $newExpiry, $cookies['wm_infinite_blockBlockID']['expire'] );
+
+ // Clean up.
+ $block->delete();
+ }
+
+ public function testSoftBlockRanges() {
+ global $wgUser;
+
+ $this->setMwGlobals( [
+ 'wgSoftBlockRanges' => [ '10.0.0.0/8' ],
+ 'wgUser' => null,
+ ] );
+
+ // IP isn't in $wgSoftBlockRanges
+ $request = new FauxRequest();
+ $request->setIP( '192.168.0.1' );
+ $wgUser = User::newFromSession( $request );
+ $this->assertNull( $wgUser->getBlock() );
+
+ // IP is in $wgSoftBlockRanges
+ $request = new FauxRequest();
+ $request->setIP( '10.20.30.40' );
+ $wgUser = User::newFromSession( $request );
+ $block = $wgUser->getBlock();
+ $this->assertInstanceOf( Block::class, $block );
+ $this->assertSame( 'wgSoftBlockRanges', $block->getSystemBlockType() );
+
+ // Make sure the block is really soft
+ $request->getSession()->setUser( $this->getTestUser()->getUser() );
+ $wgUser = User::newFromSession( $request );
+ $this->assertFalse( $wgUser->isAnon(), 'sanity check' );
+ $this->assertNull( $wgUser->getBlock() );
+ }
+
+ /**
+ * Test that a modified BlockID cookie doesn't actually load the relevant block (T152951).
+ */
+ public function testAutoblockCookieInauthentic() {
+ // Set up the bits of global configuration that we use.
+ $this->setMwGlobals( [
+ 'wgCookieSetOnAutoblock' => true,
+ 'wgCookiePrefix' => 'wmsitetitle',
+ 'wgSecretKey' => MWCryptRand::generateHex( 64, true ),
+ ] );
+
+ // 1. Log in a blocked test user.
+ $user1tmp = $this->getTestUser()->getUser();
+ $request1 = new FauxRequest();
+ $request1->getSession()->setUser( $user1tmp );
+ $block = new Block( [ 'enableAutoblock' => true ] );
+ $block->setTarget( $user1tmp );
+ $block->insert();
+ $user1 = User::newFromSession( $request1 );
+ $user1->mBlock = $block;
+ $user1->load();
+
+ // 2. Create a new request, set the cookie to an invalid value, and make sure the (anon)
+ // user not blocked.
+ $request2 = new FauxRequest();
+ $request2->setCookie( 'BlockID', $block->getId() . '!zzzzzzz' );
+ $user2 = User::newFromSession( $request2 );
+ $user2->load();
+ $this->assertTrue( $user2->isAnon() );
+ $this->assertFalse( $user2->isLoggedIn() );
+ $this->assertFalse( $user2->isBlocked() );
+
+ // Clean up.
+ $block->delete();
+ }
+
+ /**
+ * The BlockID cookie is normally verified with a HMAC, but not if wgSecretKey is not set.
+ * This checks that a non-authenticated cookie still works.
+ */
+ public function testAutoblockCookieNoSecretKey() {
+ // Set up the bits of global configuration that we use.
+ $this->setMwGlobals( [
+ 'wgCookieSetOnAutoblock' => true,
+ 'wgCookiePrefix' => 'wmsitetitle',
+ 'wgSecretKey' => null,
+ ] );
+
+ // 1. Log in a blocked test user.
+ $user1tmp = $this->getTestUser()->getUser();
+ $request1 = new FauxRequest();
+ $request1->getSession()->setUser( $user1tmp );
+ $block = new Block( [ 'enableAutoblock' => true ] );
+ $block->setTarget( $user1tmp );
+ $block->insert();
+ $user1 = User::newFromSession( $request1 );
+ $user1->mBlock = $block;
+ $user1->load();
+ $this->assertTrue( $user1->isBlocked() );
+
+ // 2. Create a new request, set the cookie to just the block ID, and the user should
+ // still get blocked when they log in again.
+ $request2 = new FauxRequest();
+ $request2->setCookie( 'BlockID', $block->getId() );
+ $user2 = User::newFromSession( $request2 );
+ $user2->load();
+ $this->assertNotEquals( $user1->getId(), $user2->getId() );
+ $this->assertNotEquals( $user1->getToken(), $user2->getToken() );
+ $this->assertTrue( $user2->isAnon() );
+ $this->assertFalse( $user2->isLoggedIn() );
+ $this->assertTrue( $user2->isBlocked() );
+ $this->assertEquals( true, $user2->getBlock()->isAutoblocking() ); // Non-strict type-check.
+
+ // Clean up.
+ $block->delete();
+ }
}
dépôts / lhc / web / wiklou.git / blobdiff