function LanguageSwitchingTest::testRestrictedPaths

Test that the language switching block does not expose restricted paths.

File

core/modules/language/tests/src/Functional/LanguageSwitchingTest.php, line 572

Class

LanguageSwitchingTest

Functional tests for the language switching feature.

Namespace

Code

public function testRestrictedPaths() : void {
  $entity_type_manager = \Drupal::entityTypeManager();
  // Add the French language.
  ConfigurableLanguage::createFromLangcode('fr')->save();
  // Enable URL language detection and selection.
  $this->config('language.types')
    ->set('negotiation.language_interface.enabled.language-url', 1)
    ->save();
  // Enable the language switching block.
  $block = $this->drupalPlaceBlock('language_block:' . LanguageInterface::TYPE_INTERFACE);
  // Create a node type and make it translatable.
  $entity_type_manager->getStorage('node_type')
    ->create([
    'type' => 'page',
    'name' => 'Page',
  ])
    ->save();
  // Create a published node with an unpublished translation.
  $node = $entity_type_manager->getStorage('node')
    ->create([
    'type' => 'page',
    'title' => $this->randomMachineName(),
    'status' => 1,
  ]);
  $node->save();
  $node->addTranslation('fr', [
    'title' => 'Non publié',
    'status' => 0,
  ]);
  $node->save();
  // Create path aliases.
  $alias_storage = $entity_type_manager->getStorage('path_alias');
  $alias_storage->create([
    'path' => '/user/1',
    'alias' => '/secret-identity/peter-parker',
  ])
    ->save();
  $alias_storage->create([
    'path' => '/node/1',
    'langcode' => 'en',
    'alias' => '/press-release/published-report',
  ])
    ->save();
  $alias_storage->create([
    'path' => '/node/1',
    'langcode' => 'fr',
    'alias' => '/press-release/rapport-non-publié',
  ])
    ->save();
  // Visit a restricted user page.
  // Assert that the language switching block is displayed on the
  // access-denied page, but it does not contain the path alias.
  $this->assertLinkMarkup('/user/1', 403, $block->label(), 'peter-parker');
  // Visit the node and its translation. Use internal paths and aliases. The
  // non-ASCII character may be escaped, so remove it from the search string.
  $this->assertLinkMarkup('/node/1', 200, $block->label(), 'rapport-non-publi');
  $this->assertLinkMarkup('/press-release/published-report', 200, $block->label(), 'rapport-non-publi');
  $this->assertLinkMarkup('/fr/node/1', 403, $block->label(), 'rapport-non-publi');
  $this->assertLinkMarkup('/fr/press-release/rapport-non-publié', 403, $block->label(), 'rapport-non-publi');
  // Test as a user with access to other users and unpublished content.
  $privileged_user = $this->drupalCreateUser([
    'access user profiles',
    'bypass node access',
  ]);
  $this->drupalLogin($privileged_user);
  $this->assertLinkMarkup('/user/1', 200, $block->label(), 'peter-parker', TRUE);
  $this->assertLinkMarkup('/node/1', 200, $block->label(), 'rapport-non-publi', TRUE);
  $this->assertLinkMarkup('/press-release/published-report', 200, $block->label(), 'rapport-non-publi', TRUE);
  $this->assertLinkMarkup('/fr/node/1', 200, $block->label(), 'rapport-non-publi', TRUE);
  $this->assertLinkMarkup('/fr/press-release/rapport-non-publié', 200, $block->label(), 'rapport-non-publi', TRUE);
  // Test as an anonymous user.
  $this->drupalLogout();
  $this->assertLinkMarkup('/user/1', 403, $block->label(), 'peter-parker');
  $this->assertLinkMarkup('/node/1', 200, $block->label(), 'rapport-non-publi');
  $this->assertLinkMarkup('/press-release/published-report', 200, $block->label(), 'rapport-non-publi');
  $this->assertLinkMarkup('/fr/node/1', 403, $block->label(), 'rapport-non-publi');
  $this->assertLinkMarkup('/fr/press-release/rapport-non-publié', 403, $block->label(), 'rapport-non-publi');
}