function LanguageSwitchingTest::testRestrictedPaths

Test that the language switching block does not expose restricted paths.

File

core/modules/language/tests/src/Functional/LanguageSwitchingTest.php, line 572

Class

LanguageSwitchingTest

Functional tests for the language switching feature.

Namespace

Code

public function testRestrictedPaths() : void {
    $entity_type_manager = \Drupal::entityTypeManager();
    // Add the French language.
    ConfigurableLanguage::createFromLangcode('fr')->save();
    // Enable URL language detection and selection.
    $this->config('language.types')
        ->set('negotiation.language_interface.enabled.language-url', 1)
        ->save();
    // Enable the language switching block.
    $block = $this->drupalPlaceBlock('language_block:' . LanguageInterface::TYPE_INTERFACE);
    // Create a node type and make it translatable.
    $entity_type_manager->getStorage('node_type')
        ->create([
        'type' => 'page',
        'name' => 'Page',
    ])
        ->save();
    // Create a published node with an unpublished translation.
    $node = $entity_type_manager->getStorage('node')
        ->create([
        'type' => 'page',
        'title' => $this->randomMachineName(),
        'status' => 1,
    ]);
    $node->save();
    $node->addTranslation('fr', [
        'title' => 'Non publié',
        'status' => 0,
    ]);
    $node->save();
    // Create path aliases.
    $alias_storage = $entity_type_manager->getStorage('path_alias');
    $alias_storage->create([
        'path' => '/user/1',
        'alias' => '/secret-identity/peter-parker',
    ])
        ->save();
    $alias_storage->create([
        'path' => '/node/1',
        'langcode' => 'en',
        'alias' => '/press-release/published-report',
    ])
        ->save();
    $alias_storage->create([
        'path' => '/node/1',
        'langcode' => 'fr',
        'alias' => '/press-release/rapport-non-publié',
    ])
        ->save();
    // Visit a restricted user page.
    // Assert that the language switching block is displayed on the
    // access-denied page, but it does not contain the path alias.
    $this->assertLinkMarkup('/user/1', 403, $block->label(), 'peter-parker');
    // Visit the node and its translation. Use internal paths and aliases. The
    // non-ASCII character may be escaped, so remove it from the search string.
    $this->assertLinkMarkup('/node/1', 200, $block->label(), 'rapport-non-publi');
    $this->assertLinkMarkup('/press-release/published-report', 200, $block->label(), 'rapport-non-publi');
    $this->assertLinkMarkup('/fr/node/1', 403, $block->label(), 'rapport-non-publi');
    $this->assertLinkMarkup('/fr/press-release/rapport-non-publié', 403, $block->label(), 'rapport-non-publi');
    // Test as a user with access to other users and unpublished content.
    $privileged_user = $this->drupalCreateUser([
        'access user profiles',
        'bypass node access',
    ]);
    $this->drupalLogin($privileged_user);
    $this->assertLinkMarkup('/user/1', 200, $block->label(), 'peter-parker', TRUE);
    $this->assertLinkMarkup('/node/1', 200, $block->label(), 'rapport-non-publi', TRUE);
    $this->assertLinkMarkup('/press-release/published-report', 200, $block->label(), 'rapport-non-publi', TRUE);
    $this->assertLinkMarkup('/fr/node/1', 200, $block->label(), 'rapport-non-publi', TRUE);
    $this->assertLinkMarkup('/fr/press-release/rapport-non-publié', 200, $block->label(), 'rapport-non-publi', TRUE);
    // Test as an anonymous user.
    $this->drupalLogout();
    $this->assertLinkMarkup('/user/1', 403, $block->label(), 'peter-parker');
    $this->assertLinkMarkup('/node/1', 200, $block->label(), 'rapport-non-publi');
    $this->assertLinkMarkup('/press-release/published-report', 200, $block->label(), 'rapport-non-publi');
    $this->assertLinkMarkup('/fr/node/1', 403, $block->label(), 'rapport-non-publi');
    $this->assertLinkMarkup('/fr/press-release/rapport-non-publié', 403, $block->label(), 'rapport-non-publi');
}