Chris@0: <?php
Chris@0: 
Chris@0: namespace Drupal\Tests\user\Functional;
Chris@0: 
Chris@0: use Drupal\Tests\BrowserTestBase;
Chris@0: 
Chris@0: /**
Chris@0:  * Tests the user search page and verifies that sensitive information is hidden
Chris@0:  * from unauthorized users.
Chris@0:  *
Chris@0:  * @group user
Chris@0:  */
Chris@0: class UserSearchTest extends BrowserTestBase {
Chris@0: 
Chris@0:   /**
Chris@0:    * Modules to enable.
Chris@0:    *
Chris@0:    * @var array
Chris@0:    */
Chris@0:   public static $modules = ['search'];
Chris@0: 
Chris@0:   public function testUserSearch() {
Chris@0:     // Verify that a user without 'administer users' permission cannot search
Chris@0:     // for users by email address. Additionally, ensure that the username has a
Chris@0:     // plus sign to ensure searching works with that.
Chris@0:     $user1 = $this->drupalCreateUser(['access user profiles', 'search content'], "foo+bar");
Chris@0:     $this->drupalLogin($user1);
Chris@0:     $keys = $user1->getEmail();
Chris@0:     $edit = ['keys' => $keys];
Chris@0:     $this->drupalPostForm('search/user', $edit, t('Search'));
Chris@0:     $this->assertText(t('Your search yielded no results.'), 'Search by email did not work for non-admin user');
Chris@0:     $this->assertText('no results', 'Search by email gave no-match message');
Chris@0: 
Chris@0:     // Verify that a non-matching query gives an appropriate message.
Chris@0:     $keys = 'nomatch';
Chris@0:     $edit = ['keys' => $keys];
Chris@0:     $this->drupalPostForm('search/user', $edit, t('Search'));
Chris@0:     $this->assertText('no results', 'Non-matching search gave appropriate message');
Chris@0: 
Chris@0:     // Verify that a user with search permission can search for users by name.
Chris@18:     $keys = $user1->getAccountName();
Chris@0:     $edit = ['keys' => $keys];
Chris@0:     $this->drupalPostForm('search/user', $edit, t('Search'));
Chris@0:     $this->assertLink($keys, 0, 'Search by username worked for non-admin user');
Chris@0: 
Chris@0:     // Verify that searching by sub-string works too.
Chris@0:     $subkey = substr($keys, 1, 5);
Chris@0:     $edit = ['keys' => $subkey];
Chris@0:     $this->drupalPostForm('search/user', $edit, t('Search'));
Chris@0:     $this->assertLink($keys, 0, 'Search by username substring worked for non-admin user');
Chris@0: 
Chris@0:     // Verify that wildcard search works.
Chris@0:     $subkey = substr($keys, 0, 2) . '*' . substr($keys, 4, 2);
Chris@0:     $edit = ['keys' => $subkey];
Chris@0:     $this->drupalPostForm('search/user', $edit, t('Search'));
Chris@0:     $this->assertLink($keys, 0, 'Search with wildcard worked for non-admin user');
Chris@0: 
Chris@0:     // Verify that a user with 'administer users' permission can search by
Chris@0:     // email.
Chris@0:     $user2 = $this->drupalCreateUser(['administer users', 'access user profiles', 'search content']);
Chris@0:     $this->drupalLogin($user2);
Chris@0:     $keys = $user2->getEmail();
Chris@0:     $edit = ['keys' => $keys];
Chris@0:     $this->drupalPostForm('search/user', $edit, t('Search'));
Chris@0:     $this->assertText($keys, 'Search by email works for administrative user');
Chris@18:     $this->assertText($user2->getAccountName(), 'Search by email resulted in username on page for administrative user');
Chris@0: 
Chris@0:     // Verify that a substring works too for email.
Chris@0:     $subkey = substr($keys, 1, 5);
Chris@0:     $edit = ['keys' => $subkey];
Chris@0:     $this->drupalPostForm('search/user', $edit, t('Search'));
Chris@0:     $this->assertText($keys, 'Search by email substring works for administrative user');
Chris@18:     $this->assertText($user2->getAccountName(), 'Search by email substring resulted in username on page for administrative user');
Chris@0: 
Chris@0:     // Verify that wildcard search works for email
Chris@0:     $subkey = substr($keys, 0, 2) . '*' . substr($keys, 4, 2);
Chris@0:     $edit = ['keys' => $subkey];
Chris@0:     $this->drupalPostForm('search/user', $edit, t('Search'));
Chris@18:     $this->assertText($user2->getAccountName(), 'Search for email wildcard resulted in username on page for administrative user');
Chris@0: 
Chris@0:     // Verify that if they search by user name, they see email address too.
Chris@18:     $keys = $user1->getAccountName();
Chris@0:     $edit = ['keys' => $keys];
Chris@0:     $this->drupalPostForm('search/user', $edit, t('Search'));
Chris@0:     $this->assertText($keys, 'Search by username works for admin user');
Chris@0:     $this->assertText($user1->getEmail(), 'Search by username for admin shows email address too');
Chris@0: 
Chris@0:     // Create a blocked user.
Chris@0:     $blocked_user = $this->drupalCreateUser();
Chris@0:     $blocked_user->block();
Chris@0:     $blocked_user->save();
Chris@0: 
Chris@0:     // Verify that users with "administer users" permissions can see blocked
Chris@0:     // accounts in search results.
Chris@18:     $edit = ['keys' => $blocked_user->getAccountName()];
Chris@0:     $this->drupalPostForm('search/user', $edit, t('Search'));
Chris@18:     $this->assertText($blocked_user->getAccountName(), 'Blocked users are listed on the user search results for users with the "administer users" permission.');
Chris@0: 
Chris@0:     // Verify that users without "administer users" permissions do not see
Chris@0:     // blocked accounts in search results.
Chris@0:     $this->drupalLogin($user1);
Chris@18:     $edit = ['keys' => $blocked_user->getAccountName()];
Chris@0:     $this->drupalPostForm('search/user', $edit, t('Search'));
Chris@0:     $this->assertText(t('Your search yielded no results.'), 'Blocked users are hidden from the user search results.');
Chris@0: 
Chris@0:     // Create a user without search permission, and one without user page view
Chris@0:     // permission. Verify that neither one can access the user search page.
Chris@0:     $user3 = $this->drupalCreateUser(['search content']);
Chris@0:     $this->drupalLogin($user3);
Chris@0:     $this->drupalGet('search/user');
Chris@0:     $this->assertResponse('403', 'User without user profile access cannot search');
Chris@0: 
Chris@0:     $user4 = $this->drupalCreateUser(['access user profiles']);
Chris@0:     $this->drupalLogin($user4);
Chris@0:     $this->drupalGet('search/user');
Chris@0:     $this->assertResponse('403', 'User without search permission cannot search');
Chris@0:     $this->drupalLogout();
Chris@0:   }
Chris@0: 
Chris@0: }