diff -u b/src/Plugin/monitoring/SensorPlugin/UserIntegritySensorPlugin.php b/src/Plugin/monitoring/SensorPlugin/UserIntegritySensorPlugin.php --- b/src/Plugin/monitoring/SensorPlugin/UserIntegritySensorPlugin.php +++ b/src/Plugin/monitoring/SensorPlugin/UserIntegritySensorPlugin.php @@ -38,7 +38,7 @@ * * @var int */ - protected $list_size =500; + protected $listSize = 500; /** * {@inheritdoc} @@ -87,21 +87,24 @@ $user_register = \Drupal::config('user.settings')->get('register'); // Check if authenticated or anonymous users have restrict access perms. - $role_ids = array_intersect($role_ids, ['authenticated', 'anonymous']); + $role_ids_after = array_intersect($role_ids, ['authenticated', 'anonymous']); $role_labels = []; - foreach (Role::loadMultiple($role_ids) as $role) { - $role_labels[$role->id()] = $role->label(); - $sensor_result->addStatusMessage($role->label() . ' has privileged access'); + foreach (Role::loadMultiple($role_ids_after) as $role) { + $role_labels[$role->id()] = $role->label() . 's'; + } + + if (!empty($role_labels)) { + $sensor_result->addStatusMessage('Privileged access for roles @roles', array('@roles' => implode(', ', $role_labels))); $sensor_result->setStatus(SensorResultInterface::STATUS_WARNING); } // Further escalate if the restricted access is for anonymous. - if (!empty($role_labels['anonymous'])) { + if ((in_array('anonymous', $role_ids))) { $sensor_result->setStatus(SensorResultInterface::STATUS_CRITICAL); } // Check if self registration is possible. - if (!empty($role_labels['authenticated']) && $user_register != USER_REGISTER_ADMINISTRATORS_ONLY) { + if ((in_array('authenticated', $role_ids)) && $user_register != USER_REGISTER_ADMINISTRATORS_ONLY) { $sensor_result->addStatusMessage('Self registration possible.'); $sensor_result->setStatus(SensorResultInterface::STATUS_CRITICAL); } @@ -121,9 +124,11 @@ return []; } + // Loading all users and managing them will kill the system so we limit + // them. $query = \Drupal::entityQuery('user') ->sort('access', 'DESC') - ->range(0, $this->list_size); + ->range(0, $this->listSize); // The authenticated role is not persisted and it could have restrict access // so we load every user. @@ -253,7 +258,7 @@ $row['expected_value'] = ['#markup' => '']; $row['time'] = ['#markup' => date("Y-m-d H:i:s", $time_stamp)]; - $row['last_accessed'] = ['#markup' => isset($last_accessed) ? date("Y-m-d H:i:s", $last_accessed) : 0]; + $row['last_accessed'] = ['#markup' => isset($last_accessed) ? date("Y-m-d H:i:s", $last_accessed) : 'Never']; $rows[] = $row; } @@ -283,7 +288,7 @@ // Show query. $output['message'] = array( '#type' => 'item', - '#title' => t('Table shows new and changed users who have privileged access.'), + '#title' => t('New and changed users with privileged access.'), ); if (count($rows) > 0) { diff -u b/src/Tests/MonitoringCoreWebTest.php b/src/Tests/MonitoringCoreWebTest.php --- b/src/Tests/MonitoringCoreWebTest.php +++ b/src/Tests/MonitoringCoreWebTest.php @@ -190,31 +190,31 @@ $this->assertTrue($result->isWarning()); // Count users included admin. - $this->assertEqual($result->getMessage(), '3 privileged user(s), Authenticated user has privileged access'); + $this->assertEqual($result->getMessage(), '3 privileged user(s), Privileged access for roles Authenticated users'); // Add permissions to anonymous user and check the sensor. user_role_grant_permissions(RoleInterface::ANONYMOUS_ID, array('administer account settings')); $result = $this->runSensor('user_integrity'); - $this->assertEqual($result->getMessage(), '3 privileged user(s), Anonymous user has privileged access, Authenticated user has privileged access'); + $this->assertEqual($result->getMessage(), '3 privileged user(s), Privileged access for roles Anonymous users, Authenticated users'); // Authenticated user with privilege of register. \Drupal::configFactory()->getEditable('user.settings')->set('register', 'visitors')->save(); $result = $this->runSensor('user_integrity'); $this->assertTrue($result->isCritical()); - $this->assertEqual($result->getMessage(), '3 privileged user(s), Anonymous user has privileged access, Authenticated user has privileged access, Self registration possible.'); + $this->assertEqual($result->getMessage(), '3 privileged user(s), Privileged access for roles Anonymous users, Authenticated users, Self registration possible.'); // Create an authenticated user and test that the sensor counter increments. $test_user_third = $this->drupalCreateUser(array(), 'test_user_3'); \Drupal::keyValue('monitoring.users')->deleteAll(); $result = $this->runSensor('user_integrity'); - $this->assertEqual($result->getMessage(), '4 privileged user(s), Anonymous user has privileged access, Authenticated user has privileged access, Self registration possible.'); + $this->assertEqual($result->getMessage(), '4 privileged user(s), Privileged access for roles Anonymous users, Authenticated users, Self registration possible.'); $test_user_third->setUsername('changed2'); $test_user_third->save(); // Check sensor message for user changes. $result = $this->runSensor('user_integrity'); - $this->assertEqual($result->getMessage(), '4 privileged user(s), 1 changed user(s), Anonymous user has privileged access, Authenticated user has privileged access, Self registration possible.'); + $this->assertEqual($result->getMessage(), '4 privileged user(s), 1 changed user(s), Privileged access for roles Anonymous users, Authenticated users, Self registration possible.'); // Check sensor message with permissions revoked. user_role_revoke_permissions(RoleInterface::ANONYMOUS_ID, array('administer account settings'));