diff --git a/core/modules/system/src/Tests/Session/SessionHttpsTest.php b/core/modules/system/src/Tests/Session/SessionHttpsTest.php index 324d1d4..3449297 100644 --- a/core/modules/system/src/Tests/Session/SessionHttpsTest.php +++ b/core/modules/system/src/Tests/Session/SessionHttpsTest.php @@ -53,11 +53,6 @@ protected function setUp() { $this->secureSessionName = 'S' . $this->getSessionName(); $this->insecureSessionName = $this->getSessionName(); } - - // Prevent that curl parses and records cookies. - $this->additionalCurlOptions = array( - CURLOPT_COOKIEJAR => FALSE, - ); } protected function testHttpsSession() { @@ -80,13 +75,11 @@ protected function testHttpsSession() { $this->assertSessionIds($ssid, $ssid, 'Session has a non-empty SID and a correct secure SID.'); // Verify that user is logged in on secure URL. - $this->curlClose(); $this->drupalGet($this->httpsUrl('admin/config')); $this->assertText(t('Configuration')); $this->assertResponse(200); // Verify that user is not logged in on non-secure URL. - $this->curlClose(); $this->drupalGet($this->httpUrl('admin/config')); $this->assertNoText(t('Configuration')); $this->assertResponse(403); @@ -133,10 +126,10 @@ protected function testMixedModeSslSession() { $user = $this->drupalCreateUser(array('access administration pages')); - $this->curlClose(); // Start an anonymous session on the insecure site. $session_data = $this->randomMachineName(); $this->drupalGet($this->httpUrl('session-test/set/') . $session_data); + $this->assertResponse(200); // Check secure cookie on insecure page. $this->assertFalse(isset($this->cookies[$this->secureSessionName]), 'The secure cookie is not sent on insecure pages.'); // Check insecure cookie on insecure page. @@ -148,11 +141,13 @@ protected function testMixedModeSslSession() { // Check that password request form action is not secure. $this->drupalGet('user/password'); + $this->assertResponse(200); $form = $this->xpath('//form[@id="user-pass"]'); $this->assertNotEqual(substr($form[0]['action'], 0, 6), 'https:', 'Password request form action is not secure'); // Check that user login form action is secure. $this->drupalGet('user'); + $this->assertResponse(200); $form = $this->xpath('//form[@id="user-login-form"]'); $this->assertEqual(substr($form[0]['action'], 0, 6), 'https:', 'Login form action is secure'); @@ -173,6 +168,7 @@ protected function testMixedModeSslSession() { // Test that session data saved before login is still available on the // authenticated session. $this->drupalGet('session-test/get'); + $this->assertResponse(200); $this->assertText($session_data, 'Session correctly returned the stored data set by the anonymous session.'); foreach ($cookies as $cookie_key => $cookie) { @@ -206,13 +202,13 @@ protected function testMixedModeSslSession() { $this->curlClose(); $this->curlCookies = array(); $this->drupalGet($this->httpsUrl('session-test/set/1')); + $this->assertResponse(200); $this->curlCookies = array( $this->insecureSessionName . '=' . $this->cookies[$this->insecureSessionName]['value'], $this->secureSessionName . '=' . $this->cookies[$this->secureSessionName]['value'], ); // Mock a login to the secure site using the secure session cookie. - $this->curlClose(); $this->loginHttps($user); // Test that the user is also authenticated on the insecure site. @@ -244,8 +240,8 @@ protected function testCsrfTokenWithMixedModeSsl() { $this->assertSessionIds($sid, $ssid, 'Session has both secure and insecure SIDs'); // Retrieve the form via HTTP. - $this->curlClose(); $this->drupalGet($this->httpUrl('session-test/form')); + $this->assertResponse(200); $http_token = $this->getFormToken(); // Verify that submitting form values via HTTPS to a form originally @@ -253,7 +249,6 @@ protected function testCsrfTokenWithMixedModeSsl() { $form = $this->xpath('//form[@id="session-test-form"]'); $form[0]['action'] = $this->httpsUrl('session-test/form'); $edit = array('input' => $this->randomMachineName(32)); - $this->curlClose(); $maximum_redirects = $this->maximumRedirects; $this->maximumRedirects = 0; @@ -268,8 +263,8 @@ protected function testCsrfTokenWithMixedModeSsl() { $this->assertText(String::format('Ok: @input', array('@input' => $edit['input']))); // Retrieve the same form via HTTPS. - $this->curlClose(); $this->drupalGet($this->httpsUrl('session-test/form')); + $this->assertResponse(200); $https_token = $this->getFormToken(); // Verify that CSRF token values are the same for a form regardless of @@ -297,8 +292,6 @@ protected function loginHttp(AccountInterface $account) { $this->drupalPostForm(NULL, $edit, t('Log in')); $this->maximumRedirects = $maximum_redirects; - $this->curlCookies = array($this->insecureSessionName . '=' . $this->cookies[$this->insecureSessionName]['value']); - // Follow the location header. $path = $this->getPathFromLocationHeader(FALSE); $this->drupalGet($this->httpUrl($path)); @@ -325,24 +318,14 @@ protected function loginHttps(AccountInterface $account) { $this->drupalPostForm(NULL, $edit, t('Log in')); $this->maximumRedirects = $maximum_redirects; - // When logging in via the HTTPS mock, the child site will issue a secure - // session cookie. While this cookie will be stored in the curl handle, it - // will not be used on subsequent requests via the HTTPS mock, unless when - // operating in a true HTTPS environment. Therefore it is necessary to - // collect the session cookies and use them on subsequent requests via the - // HTTPS mock. Note that we need to collect both of the session cookies, - // otherwise the session will be rejected when operating in mixed mode ssl. + // When logging in via the HTTPS mock, the child site will issue a session + // cookie with the secure attribute set. While this cookie will be stored in + // the curl handle, it will not be used on subsequent requests via the HTTPS + // mock, unless when operating in a true HTTPS environment. Therefore it is + // necessary to manually collect the session cookie and add it to the + // curlCookies property such that it will be used on subsequent requests via + // the HTTPS mock. $this->curlCookies = array($this->secureSessionName . '=' . $this->cookies[$this->secureSessionName]['value']); - if (isset($this->cookies[$this->insecureSessionName]['value'])) { - $this->curlCookies[] = $this->insecureSessionName . '=' . $this->cookies[$this->insecureSessionName]['value']; - } - //$session_cookies = []; - //foreach ([$this->insecureSessionName, $this->secureSessionName] as $cookie) { - // if (isset($this->cookies[$cookie]['value']) && $this->cookies[$cookie]['value'] != 'deleted') { - // $session_cookies[] = $cookie . '=' . $this->cookies[$cookie]['value']; - // } - //} - //$cookie = implode('; ', $session_cookies); // Follow the location header. $path = $this->getPathFromLocationHeader(TRUE);