function ManagedFileFidValidationTest::testOtherUsersFileIdNotAcceptedViaUrl

Tests that other users' file IDs are rejected when passed via URL.

File

core/modules/file/tests/src/Functional/ManagedFileFidValidationTest.php, line 82

Class

ManagedFileFidValidationTest

Tests the file validation in the ManagedFile element for private files.

Namespace

Code

public function testOtherUsersFileIdNotAcceptedViaUrl() : void {
  $this->drupalLogin($this->anotherUser);
  $owner_fid = $this->ownerFile
    ->id();
  // Visit the form with the other user's file ID in the URL.
  $this->drupalGet('file/test/1/1/1/' . $owner_fid);
  $this->submitForm([], 'Save');
  $this->getSession()
    ->getPage()
    ->getText();
  $this->assertSession()
    ->pageTextContains('The file ids are');
  $response = $this->getSession()
    ->getPage()
    ->getText();
  $this->assertStringNotContainsString("The file ids are {$owner_fid}.", $response);
  $this->assertSession()
    ->pageTextContains('The file ids are .');
}