function FileFieldWidgetTest::testTemporaryFileRemovalExploitAnonymous

Tests exploiting the temporary file removal for anonymous users using fid.

File

core/modules/file/tests/src/Functional/FileFieldWidgetTest.php, line 451

Class

FileFieldWidgetTest

Tests the file field widget with public and private files.

Namespace

Code

public function testTemporaryFileRemovalExploitAnonymous() {
    // Set up an anonymous victim user.
    $victim_user = User::getAnonymousUser();
    // Set up an anonymous attacker user.
    $attacker_user = User::getAnonymousUser();
    // Set up permissions for anonymous attacker user.
    user_role_change_permissions(RoleInterface::ANONYMOUS_ID, [
        'access content' => TRUE,
        'create article content' => TRUE,
        'edit any article content' => TRUE,
    ]);
    // Log out so as to be the anonymous attacker user.
    $this->drupalLogout();
    // Perform tests using the newly set up anonymous users.
    $this->doTestTemporaryFileRemovalExploit($victim_user, $attacker_user);
}