public function SessionHttpsTestCase::testEmptySessionId

Tests that empty session IDs do not cause unrelated sessions to load.

File

core/modules/simpletest/tests/session.test, line 470

Provides SimpleTests for core session handling functionality.

Class

SessionHttpsTestCase

Ensure that when running under HTTPS two session cookies are generated.

Code

public function testEmptySessionId() {
  global $is_https;

  if ($is_https) {
    $secure_session_name = session_name();
  }
  else {
    $secure_session_name = 'S' . session_name();
  }

  session_test_boot();

  $admin_user = $this->backdropCreateUser(array('access administration pages'));
  $standard_user = $this->backdropCreateUser(array('access content'));

  // Login the admin user first on HTTP.
  // We cannot use $this->backdropLogin() here because we need to use the
  // special http.php URLs.
  $edit = array(
    'name' => $admin_user->name,
    'pass' => $admin_user->pass_raw
  );
  $this->backdropGet('user/login');
  $form = $this->xpath('//form[@id="user-login"]');
  $form[0]['action'] = $this->httpUrl('user/login');
  $this->backdropPost(NULL, $edit, t('Log in'));

  $this->curlClose();

  // Now start a session for the standard user on HTTPS.
  $edit = array(
    'name' => $standard_user->name,
    'pass' => $standard_user->pass_raw
  );
  $this->backdropGet('user/login');
  $form = $this->xpath('//form[@id="user-login"]');
  $form[0]['action'] = $this->httpsUrl('user/login');
  $this->backdropPost(NULL, $edit, t('Log in'));

  // Make the secure session cookie blank.
  curl_setopt($this->curlHandle, CURLOPT_COOKIE, "$secure_session_name=");
  $this->backdropGet($this->httpsUrl('user/login'));
  $this->assertNoText($admin_user->name, 'User is not logged in as admin');
  $this->assertNoText($standard_user->name, "The user's own name is not displayed because the invalid session cookie has logged them out.");
}