diff -u b/src/Plugin/monitoring/SensorPlugin/UserIntegritySensorPlugin.php b/src/Plugin/monitoring/SensorPlugin/UserIntegritySensorPlugin.php --- b/src/Plugin/monitoring/SensorPlugin/UserIntegritySensorPlugin.php +++ b/src/Plugin/monitoring/SensorPlugin/UserIntegritySensorPlugin.php @@ -75,14 +75,17 @@ } } - // Check role IDs with restricted permissions and show a message. + // Check anonymous and authenticated users with restricted permissions and + // show a message. + $user_register = \Drupal::config('user.settings')->get('register'); + $role_ids = array_intersect($role_ids, ['authenticated', 'anonymous']); foreach (Role::loadMultiple($role_ids) as $role) { - if ($role->id() != 'anonymous' && !$role->hasPermission('administer account settings')) { + if ($role->id() == 'authenticated' && $user_register == USER_REGISTER_ADMINISTRATORS_ONLY) { $sensor_result->addStatusMessage($role->label() . ' has privileged access but not for registration'); $sensor_result->setStatus(SensorResultInterface::STATUS_WARNING); } - elseif (!$role->isAdmin()) { - $sensor_result->addStatusMessage($role->label() . ' has privileged access including registration'); + else { + $sensor_result->addStatusMessage($role->label() . ' has privileged access'); $sensor_result->setStatus(SensorResultInterface::STATUS_CRITICAL); } } diff -u b/src/Tests/MonitoringCoreWebTest.php b/src/Tests/MonitoringCoreWebTest.php --- b/src/Tests/MonitoringCoreWebTest.php +++ b/src/Tests/MonitoringCoreWebTest.php @@ -156,47 +156,49 @@ $this->drupalLogin($test_user_first); // Check sensor message after first privilege user creation. $result = $this->runSensor('user_integrity'); - $this->assertTrue(strpos($result->getMessage(), '1 privileged user(s)') !== FALSE); + $this->assertEqual($result->getMessage(), '1 privileged user(s)'); // Create second privileged user. $test_user_second = $this->drupalCreateUser(array(), 'test_user_2', TRUE); $this->drupalLogin($test_user_second); // Check sensor message after new privilege user creation. $result = $this->runSensor('user_integrity'); - $this->assertTrue(strpos($result->getMessage(), '2 privileged user(s), 1 new user(s)') !== FALSE); + $this->assertEqual($result->getMessage(), '2 privileged user(s), 1 new user(s)'); // Reset the user data, button is tested in UI tests. \Drupal::keyValue('monitoring.users')->deleteAll(); $result = $this->runSensor('user_integrity'); - $this->assertTrue(strpos($result->getMessage(), '2 privileged user(s)') !== FALSE); + $this->assertEqual($result->getMessage(), '2 privileged user(s)'); // Make changes to a user. $test_user_second->setUsername('changed'); $test_user_second->save(); // Check sensor message for user changes. $result = $this->runSensor('user_integrity'); - $this->assertTrue(strpos($result->getMessage(), '2 privileged user(s), 1 changed user(s)') !== FALSE); + $this->assertEqual($result->getMessage(), '2 privileged user(s), 1 changed user(s)'); // Reset the user data again, check sensor message. \Drupal::keyValue('monitoring.users')->deleteAll(); $result = $this->runSensor('user_integrity'); - $this->assertTrue(strpos($result->getMessage(), '2 privileged user(s)') !== FALSE); + $this->assertEqual($result->getMessage(), '2 privileged user(s)'); - // Check if authenticated or anonymous users have privileged access. - // Create an authenticated user with privilege of registration.. - $test_user_third = $this->drupalCreateUser([ - 'administer account settings', - ]); - $this->drupalLogin($test_user_third); + // Add permissions to authenticated user with no privilege of registration. + \Drupal::configFactory()->getEditable('user.settings')->set('register', 'admin_only')->save(); + user_role_grant_permissions(RoleInterface::AUTHENTICATED_ID, array('administer account settings')); $result = $this->runSensor('user_integrity'); + $this->assertTrue($result->isWarning()); + $this->assertEqual($result->getMessage(), '2 privileged user(s), Authenticated user has privileged access but not for registration'); - $role_id = user_role_load($test_user_third->getRoles()[1]); - $this->assertTrue(strpos($result->getMessage(), $role_id->label() . ' has privileged access including registration') !== FALSE); - - // Add privileges to anonymous user and check the sensor. + // Add permissions to anonymous user and check the sensor. user_role_grant_permissions(RoleInterface::ANONYMOUS_ID, array('administer account settings')); $result = $this->runSensor('user_integrity'); - $this->assertTrue(strpos($result->getMessage(), 'Anonymous user has privileged access including registration') !== FALSE); + $this->assertEqual($result->getMessage(), '2 privileged user(s), Anonymous user has privileged access, Authenticated user has privileged access but not for registration'); + + // Authenticated user with privilege of registration. + \Drupal::configFactory()->getEditable('user.settings')->set('register', 'visitors')->save(); + $result = $this->runSensor('user_integrity'); + $this->assertTrue($result->isCritical()); + $this->assertEqual($result->getMessage(), '2 privileged user(s), Anonymous user has privileged access, Authenticated user has privileged access'); } /**