diff --git a/core/modules/views/src/Tests/BulkOperationAccessTest.php b/core/modules/views/src/Tests/BulkOperationAccessTest.php new file mode 100644 index 0000000..34bc727 --- /dev/null +++ b/core/modules/views/src/Tests/BulkOperationAccessTest.php @@ -0,0 +1,72 @@ +adminUser = $this->drupalCreateUser(array('administer users', 'access user profiles')); + $this->regularUser = $this->drupalCreateUser(); + } + + /** + * Tests that a user can't perform a forbidden action with bulk operations. + */ + public function testViewsBulkOperationAccessCheck() { + $this->drupalLogin($this->adminUser); + + + $options = array('query' => array('user' => $this->regularUser->getUsername())); + $edit = array( + 'action' => 'user_cancel_user_action', + 'user_bulk_form[0]' => TRUE, + ); + $this->drupalPostForm('admin/people', $edit, t('Apply'), $options); + + + $edit = array( + 'accounts[' . $this->regularUser->id() . ']' => 'user_cancel_user_action', + 'operation' => 'cancel', + 'user_cancel_method' => 'user_cancel_delete', + 'confirm' => TRUE, + ); + $this->drupalPostForm('admin/people/cancel', $edit, t('Cancel accounts')); + $this->assertNotNull(\Drupal\user\Entity\User::load($this->regularUser->id()), 'The user is still exists.'); + } + +}