function SecurityAdvisoryTest::testPsa

Tests that a security advisory is displayed.

File

core/modules/system/tests/src/Functional/SecurityAdvisories/SecurityAdvisoryTest.php, line 118

Class

SecurityAdvisoryTest

Tests of security advisories functionality.

Namespace

Code

public function testPsa() : void {
    $assert = $this->assertSession();
    // Setup test PSA endpoint.
    AdvisoryTestClientMiddleware::setTestEndpoint($this->workingEndpointMixed);
    $mixed_advisory_links = [
        'Critical Release - SA-2019-02-19',
        'Critical Release - PSA-Really Old',
        // The info for the test modules 'generic_module1_test' and
        // 'generic_module2_test' are altered for this test so match the items in
        // the test json feeds.
        // @see advisory_feed_test_system_info_alter()
'Generic Module1 Project - Moderately critical - Access bypass - SA-CONTRIB-2019-02-02',
        'Generic Module2 project - Moderately critical - Access bypass - SA-CONTRIB-2019-02-02',
    ];
    // Confirm that links are not displayed if they are enabled.
    $this->config('system.advisories')
        ->set('enabled', FALSE)
        ->save();
    $this->assertAdvisoriesNotDisplayed($mixed_advisory_links);
    $this->config('system.advisories')
        ->set('enabled', TRUE)
        ->save();
    // A new request for the JSON feed will not be made on admin pages besides
    // the status report.
    $this->assertAdvisoriesNotDisplayed($mixed_advisory_links, [
        'system.admin',
    ]);
    // If both PSA and non-PSA advisories are displayed they should be displayed
    // as errors.
    $this->assertStatusReportLinks($mixed_advisory_links, REQUIREMENT_ERROR);
    // The advisories will be displayed on admin pages if the response was
    // stored from the status report request.
    $this->assertAdminPageLinks($mixed_advisory_links, REQUIREMENT_ERROR);
    // Confirm that a user without the correct permission will not see the
    // advisories on admin pages.
    $this->drupalLogin($this->drupalCreateUser([
        'access administration pages',
        // We have nothing under admin, so we need access to a child route to
        // access the parent.
'administer modules',
    ]));
    $this->assertAdvisoriesNotDisplayed($mixed_advisory_links, [
        'system.admin',
    ]);
    // Log back in with user with permission to see the advisories.
    $this->drupalLogin($this->user);
    // Test cache.
    AdvisoryTestClientMiddleware::setTestEndpoint($this->nonWorkingEndpoint);
    $this->assertAdminPageLinks($mixed_advisory_links, REQUIREMENT_ERROR);
    $this->assertStatusReportLinks($mixed_advisory_links, REQUIREMENT_ERROR);
    // Tests transmit errors with a JSON endpoint.
    $this->tempStore
        ->delete('advisories_response');
    $this->assertAdvisoriesNotDisplayed($mixed_advisory_links);
    // Test that the site status report displays an error.
    $this->drupalGet(Url::fromRoute('system.status'));
    $assert->pageTextContains('Failed to fetch security advisory data:');
    // Test a PSA endpoint that returns invalid JSON.
    AdvisoryTestClientMiddleware::setTestEndpoint($this->invalidJsonEndpoint, TRUE);
    // Assert that are no logged error messages before attempting to fetch the
    // invalid endpoint.
    $this->assertServiceAdvisoryLoggedErrors([]);
    // On admin pages no message should be displayed if the feed is malformed.
    $this->assertAdvisoriesNotDisplayed($mixed_advisory_links);
    // Assert that there was an error logged for the invalid endpoint.
    $this->assertServiceAdvisoryLoggedErrors([
        'The security advisory JSON feed from Drupal.org could not be decoded.',
    ]);
    // On the status report there should be no announcements section.
    $this->drupalGet(Url::fromRoute('system.status'));
    $assert->pageTextNotContains('Failed to fetch security advisory data:');
    // Assert the error was logged again.
    $this->assertServiceAdvisoryLoggedErrors([
        'The security advisory JSON feed from Drupal.org could not be decoded.',
    ]);
    AdvisoryTestClientMiddleware::setTestEndpoint($this->workingEndpointPsaOnly, TRUE);
    $psa_advisory_links = [
        'Critical Release - PSA-Really Old',
        'Generic Module2 project - Moderately critical - Access bypass - SA-CONTRIB-2019-02-02',
    ];
    // Admin page will not display the new links because a new feed request is
    // not attempted.
    $this->assertAdvisoriesNotDisplayed($psa_advisory_links, [
        'system.admin',
    ]);
    // If only PSA advisories are displayed they should be displayed as
    // warnings.
    $this->assertStatusReportLinks($psa_advisory_links, REQUIREMENT_WARNING);
    $this->assertAdminPageLinks($psa_advisory_links, REQUIREMENT_WARNING);
    AdvisoryTestClientMiddleware::setTestEndpoint($this->workingEndpointNonPsaOnly, TRUE);
    $non_psa_advisory_links = [
        'Critical Release - SA-2019-02-19',
        'Generic Module1 Project - Moderately critical - Access bypass - SA-CONTRIB-2019-02-02',
    ];
    // If only non-PSA advisories are displayed they should be displayed as
    // errors.
    $this->assertStatusReportLinks($non_psa_advisory_links, REQUIREMENT_ERROR);
    $this->assertAdminPageLinks($non_psa_advisory_links, REQUIREMENT_ERROR);
    // Confirm that advisory fetching can be disabled after enabled.
    $this->config('system.advisories')
        ->set('enabled', FALSE)
        ->save();
    $this->assertAdvisoriesNotDisplayed($non_psa_advisory_links);
    // Assert no other errors were logged.
    $this->assertServiceAdvisoryLoggedErrors([]);
}