user_password_reset.test

<?php
/**
 * @file
 * Tests for resetting the password.
 */

class UserPasswordResetTest extends BackdropWebTestCase {
  protected $profile = 'testing';

  function setUp($modules = array()) {
    $modules = array_merge($modules, array('image'));
    parent::setUp($modules);

    // Create a user.
    $account = $this->backdropCreateUser(array());

    // Activate user by logging in.
    $this->backdropLogin($account);

    $this->account = user_load($account->uid, TRUE);
    $this->backdropLogout();

    // Set the last login time that is used to generate the one-time link so
    // that it is definitely over a second ago.
    $account->login = REQUEST_TIME - mt_rand(10, 100000);
    db_update('users')
      ->fields(array('login' => $account->login))
      ->condition('uid', $account->uid)
      ->execute();
  }

  /**
   * Retrieves password reset email and extracts the login link.
   */
  protected function getResetURL() {
    // Assume the most recent email.
    $_emails = $this->backdropGetMails();
    $email = end($_emails);
    $urls = array();
    preg_match('#.+user/reset/.+#', $email['body'], $urls);

    return $urls[0];
  }

  /**
   * Tests password reset functionality.
   */
  function testUserPasswordReset() {
    // Try to reset the password for an invalid account.
    $this->backdropGet('user/password');

    $edit = array('name' => $this->randomName(32));
    $this->backdropPost(NULL, $edit, t('Reset password'));

    $this->assertRaw(t('Sorry, %name is not recognized as a user name or an e-mail address.', array('%name' => $edit['name'])), 'Validation error message shown when trying to request password for invalid account.');
    $this->assertEqual(count($this->backdropGetMails(array('id' => 'user_password_reset'))), 0, 'No e-mail was sent when requesting a password for an invalid account.');

    // Reset the password by username via the password reset page.
    $edit['name'] = $this->account->name;
    $this->backdropPost(NULL, $edit, t('Reset password'));

     // Verify that the user was sent an e-mail.
    $this->assertMail('to', $this->account->mail, 'Password e-mail sent to user.');
    $subject = t('Password reset information for @username at @site', array('@username' => $this->account->name, '@site' => config_get('system.core', 'site_name')));
    $this->assertMail('subject', $subject, 'Password reset e-mail subject is correct.');

    $resetURL = $this->getResetURL();
    $this->backdropGet($resetURL);

    // Check that password value is required.
    $this->backdropPost(NULL, array(), t('Save password & log in'));
    $this->assertText(t('Password field is required.'));

    // Check successful login with values.
    $pass = user_password();
    $pass_edit = array(
      'pass[pass1]' => $pass,
      'pass[pass2]' => $pass,
    );
    $this->backdropPost(NULL, $pass_edit, t('Save password & log in'));
    $this->assertLink(t('Log out'));
    $this->assertUrl('<front>');

    // Log out, and try to log in again using the same one-time link.
    $this->backdropLogout();
    $this->backdropGet($resetURL);
    $this->assertText(t('You have tried to use a reset password link that has either been used or is no longer valid. Please request a new one using the form below.'), 'One-time link is no longer valid.');

    // Request a new password again, this time using the e-mail address.
    $this->backdropGet('user/password');
    // Count email messages before to compare with after.
    $before = count($this->backdropGetMails(array('id' => 'user_password_reset')));
    $edit['name'] = $this->account->mail;
    $this->backdropPost(NULL, $edit, t('Reset password'));
    $this->assertTrue( count($this->backdropGetMails(array('id' => 'user_password_reset'))) === $before + 1, 'E-mail sent when requesting password reset using e-mail address.');

    // Log in the user using password reset url.
    $user_pass_reset_url = $this->getResetURL();
    $new_password = user_password();
    $edit = array(
      'pass[pass1]' => $new_password,
      'pass[pass2]' => $new_password,
    );
    $this->backdropPost($user_pass_reset_url, $edit, t('Save password & log in'));
    $this->assertText(t('Your account password has been updated.'), 'One time login with password reset completed.');
    $this->account = user_load($this->account->uid, TRUE);
    $this->assertTrue(user_check_password($new_password, $this->account), 'Password reset successful.');
    $this->backdropLogout();

    // Create a password reset link as if the request time was 60 seconds older than the allowed limit.
    $timeout = 86400;
    $bogus_timestamp = REQUEST_TIME - $timeout - 60;
    $this->backdropGet("user/reset/{$this->account->uid}/$bogus_timestamp/" . user_pass_rehash($this->account->pass, $bogus_timestamp, $this->account->login, $this->account->uid));
    $this->assertText(t('You have tried to use a reset password link that has expired. Please request a new one using the form below.'), 'Expired password reset request rejected.');
    $this->backdropLogout();

    // Test an immediate login, without the reset form.
    sleep(1);
    $timestamp = time();
    $this->backdropGet("user/reset/{$this->account->uid}/$timestamp/" . user_pass_rehash($this->account->pass, $timestamp, $this->account->login, $this->account->uid) . '/login');
    $this->assertText(t('You have used your one-time log-in link and are now logged-in.'), 'Immediate login link message shown.');
    $this->backdropGet("user/{$this->account->uid}/edit");
    $this->assertResponse(200, 'Immediate login link logged user in.');
  }

 /**
  * Prefill the text box on incorrect login via link to password reset page.
  */
  function testUserResetPasswordTextboxFilled() {
    $this->backdropGet('user/login');
    $edit = array(
      'name' => $this->randomName(),
      'pass' => $this->randomName(),
    );
    $this->backdropPost('user', $edit, t('Log in'));
    $this->assertText(t('Sorry, unrecognized username.'));
    unset($edit['pass']);
    $this->backdropGet('user/password', array('query' => array('name' => $edit['name'])));
    $this->assertFieldByName('name', $edit['name'], 'User name pre-populated into name field.');
  }

  /**
   * Make sure that users cannot forge password reset URLs of other users.
   */
  function testResetImpersonation() {
    // Make sure user 1 has a valid password, so it does not interfere with the
    // test user accounts that are created below.
    $account = user_load(1);
    $account->pass = user_password();
    $account->save();

    // Create two user accounts with empty passwords. The only way to have an
    // empty password is to force it in the database, so do that and reload the
    // acounts afterwards.
    $user1 = $this->backdropCreateUser();
    $user2 = $this->backdropCreateUser();
    db_update('users')
      ->fields(array('pass' => ''))
      ->condition('uid', array($user1->uid, $user2->uid), 'IN')
      ->execute();
    $user1 = user_load($user1->uid);
    $user2 = user_load($user2->uid);

    // The password reset URL must not be valid for the second user when only
    // the user ID is changed in the URL.
    $reset_url = user_pass_reset_url($user1);
    $attack_reset_url = str_replace("user/reset/$user1->uid", "user/reset/$user2->uid", $reset_url);
    $this->backdropGet($attack_reset_url);
    $this->assertUrl('user/password', array(), 'The user is redirected to the password reset request page.');
    $this->assertText('You have tried to use a reset password link that has either been used or is no longer valid. Please request a new one using the form below.');

    // When legacy code calls user_pass_rehash() without providing the $uid
    // parameter, neither password reset URL should be valid since it is
    // impossible for the system to determine which user account the token was
    // intended for.
    $timestamp = REQUEST_TIME;
    // Pass an explicit NULL for the $uid parameter of user_pass_rehash()
    // rather than not passing it at all, to avoid triggering PHP warnings in
    // the test.
    $reset_url_token = user_pass_rehash($user1->pass, $timestamp, $user1->login, NULL);
    $reset_url = url("user/reset/$user1->uid/$timestamp/$reset_url_token", array('absolute' => TRUE));
    $this->backdropGet($reset_url);
    $this->assertUrl('user/password', array(), 'The user is redirected to the password reset request page.');
    $this->assertText('You have tried to use a reset password link that has either been used or is no longer valid. Please request a new one using the form below.');
    $attack_reset_url = str_replace("user/reset/$user1->uid", "user/reset/$user2->uid", $reset_url);
    $this->backdropGet($attack_reset_url);
    $this->assertUrl('user/password', array(), 'The user is redirected to the password reset request page.');
    $this->assertText('You have tried to use a reset password link that has either been used or is no longer valid. Please request a new one using the form below.');

    // To verify that user_pass_rehash() never returns a valid result in the
    // above situation (even if legacy code also called it to attempt to
    // validate the token, rather than just to generate the URL), check that a
    // second call with the same parameters produces a different result.
    $new_reset_url_token = user_pass_rehash($user1->pass, $timestamp, $user1->login, NULL);
    $this->assertNotEqual($reset_url_token, $new_reset_url_token);

    // However, when the duplicate account is removed, the password reset URL
    // should be valid.
    user_delete($user2->uid);
    $reset_url_token = user_pass_rehash($user1->pass, $timestamp, $user1->login, NULL);
    $reset_url = url("user/reset/$user1->uid/$timestamp/$reset_url_token", array('absolute' => TRUE));
    $this->backdropGet($reset_url);
    $this->assertUrl($reset_url, array(), 'The user remains on the password reset login page.');
    $this->assertNoText('You have tried to use a reset password link that has either been used or is no longer valid. Please request a new one using the form below.');
  }

}