Account Suspended
Account Suspended
This Account has been suspended.
Contact your hosting provider for more information.
 All Data Structures Functions Variables Pages
OtherSecurityTest.php
1 <?php
2  /*********************************************************************************
3  * Zurmo is a customer relationship management program developed by
4  * Zurmo, Inc. Copyright (C) 2017 Zurmo Inc.
5  *
6  * Zurmo is free software; you can redistribute it and/or modify it under
7  * the terms of the GNU Affero General Public License version 3 as published by the
8  * Free Software Foundation with the addition of the following permission added
9  * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK
10  * IN WHICH THE COPYRIGHT IS OWNED BY ZURMO, ZURMO DISCLAIMS THE WARRANTY
11  * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS.
12  *
13  * Zurmo is distributed in the hope that it will be useful, but WITHOUT
14  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
15  * FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
16  * details.
17  *
18  * You should have received a copy of the GNU Affero General Public License along with
19  * this program; if not, see http://www.gnu.org/licenses or write to the Free
20  * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
21  * 02110-1301 USA.
22  *
23  * You can contact Zurmo, Inc. with a mailing address at 27 North Wacker Drive
24  * Suite 370 Chicago, IL 60606. or at email address contact@zurmo.com.
25  *
26  * The interactive user interfaces in original and modified versions
27  * of this program must display Appropriate Legal Notices, as required under
28  * Section 5 of the GNU Affero General Public License version 3.
29  *
30  * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
31  * these Appropriate Legal Notices must retain the display of the Zurmo
32  * logo and Zurmo copyright notice. If the display of the logo is not reasonably
33  * feasible for technical reasons, the Appropriate Legal Notices must display the words
34  * "Copyright Zurmo Inc. 2017. All rights reserved".
35  ********************************************************************************/
36 
37  // Tests that don't seem to have a home.
39  {
40  public function testStrongerIntegerNotSavingAsInteger()
41  {
42  SecurityTestHelper::createSuperAdmin();
43  Yii::app()->user->userModel = User::getByUsername('super');
44  $user = UserTestHelper::createBasicUser('arrry');
45  $userId = $user->id;
46 
47  $user2 = UserTestHelper::createBasicUser('brrry');
48  $user2Id = $user2->id;
49 
50  $a = new Group();
51  $a->name = 'RRRRRA';
52  $this->assertTrue($a->save());
53  $a->users ->add($user);
54  $a->users ->add($user2);
55  $a->save();
56  $user->forget();
57  $user2->forget();
58  $a->forget();
59  unset($a);
60  unset($user);
61  unset($user2);
62  $a = Group::getByName('RRRRRA');
64  $policiesForm = PoliciesFormUtil::makeFormFromPoliciesData($data);
65  $fakePost = array(
66  'UsersModule__POLICY_ENFORCE_STRONG_PASSWORDS' => '',
67  'UsersModule__POLICY_MINIMUM_PASSWORD_LENGTH__helper' => '1',
68  'UsersModule__POLICY_MINIMUM_PASSWORD_LENGTH' => '5',
69  'UsersModule__POLICY_MINIMUM_USERNAME_LENGTH__helper' => '1',
70  'UsersModule__POLICY_MINIMUM_USERNAME_LENGTH' => '5',
71  'UsersModule__POLICY_PASSWORD_EXPIRES' => '',
72  );
73  $validatedAndCastedPostData = PoliciesFormUtil::typeCastPostData($fakePost);
74  $policiesForm = PoliciesFormUtil::loadFormFromCastedPost($policiesForm,
75  $validatedAndCastedPostData);
76  $this->assertTrue($policiesForm->validate());
78  $validatedAndCastedPostData, $a);
79  $this->assertTrue($saved);
80  $a->forget();
81  $user = User::getById($userId);
82  $user2 = User::getById($user2Id);
85  $user->forget();
86  $user2->forget();
87  }
88 
93  {
94  Yii::app()->user->userModel = User::getByUsername('super');
95  $group = Group::getByName('RRRRRA');
96  $item = NamedSecurableItem::getByName('AccountsModule');
97  $item->addPermissions($group, Permission::READ, Permission::ALLOW);
98  $item->addPermissions($group, Permission::WRITE, Permission::DENY);
99  $item->addPermissions($group, Permission::WRITE, Permission::DENY);
100  $item->save();
101  $item = NamedSecurableItem::getByName('LeadsModule');
102  $item->addPermissions($group, Permission::READ, Permission::ALLOW);
103  $item->save();
104  $group->forget();
105  $item->forget();
106  unset($item);
107  unset($group);
108  $group = Group::getByName('RRRRRA');
109  $group->users->removeAll();
110  $group->groups->removeAll();
111  $group->save();
112  $group->delete();
113  $group->forget();
114  unset($group);
115  $user = User::getByUsername('arrry');
116  $modulePermissionsData = PermissionsUtil::getAllModulePermissionsDataByPermitable($user);
117  $user->forget();
118  unset($user);
119  }
120 
121  public function testUserCanReadEmptyModelWithoutPermissionAndNoDefaultsSetOnModelButCantSaveItUntilTheySetAnOwner()
122  {
123  $user = UserTestHelper::createBasicUser('atester');
124  $this->assertTrue($user->id > 0);
125  $item = NamedSecurableItem::getByName('AccountsModule');
126  $this->assertEquals(Permission::NONE, $item->getEffectivePermissions($user));
127  Yii::app()->user->userModel = $user;
128  $account = new Account(false);
129  $this->assertEquals('', $account->name);
130  $account->name = 'Something Corp';
131  $account->validate();
132  $this->assertFalse($account->save());
133  $this->assertEquals(
134  array('owner' =>
135  array('username' =>
136  array('Username cannot be blank.'),
137  'lastName' =>
138  array('Last Name cannot be blank.'),
139  )
140  ),
141  $account->getErrors());
142  }
143 
148  {
149  $user = User::getByUsername('atester');
150  $user2 = UserTestHelper::createBasicUser('atester2');
151  $item = NamedSecurableItem::getByName('AccountsModule');
152  $this->assertEquals(Permission::NONE, $item->getEffectivePermissions($user));
153  Yii::app()->user->userModel = $user;
154  $account = new Account(false);
155  // When an account has no owner (meaning the unsaved user
156  // automatically) associated with it can be manipulated
157  // but whoever created.
158  $this->assertEquals('', $account->name);
159  // If it is given away...
160  $account->owner = $user2;
161  $account->save();
162  try
163  {
164  // They lose access to it.
165  $name = $account->name;
166  //They should still have access to it. This is a change made in 2.0.13 to properly support cloning.
167  }
169  {
170  $this->fail();
171  }
172  try
173  {
174  // AS of 2.0.13 they should be able to get it back.
175  $account->owner = new User();
176  }
178  {
179  $this->fail();
180  }
181  }
182 
183  public function testUserCannotSeeRelatedModelInformationWithLimitedPermissions()
184  {
185  Yii::app()->user->userModel = User::getByUsername('super');
187  $user = UserTestHelper::createBasicUser('dtester');
188  $this->assertTrue($user->id > 0);
189 
190  $user = UserTestHelper::createBasicUser('etester');
191  $this->assertTrue($user->id > 0);
192 
193  $account = new Account();
194  $account->name = 'DAccount';
195  $account->owner = User::getByUsername('dtester');
196  $saved = $account->save();
197  assert('$saved'); // Not Coding Standard
198 
199  $states = ContactState::GetAll();
200  $contact = new Contact();
201  $contact->owner = User::getByUsername('etester');
202  $contact->account = $account;
203  $contact->title->value = 'Mr.';
204  $contact->firstName = 'Super';
205  $contact->lastName = 'Man';
206  $contact->state = $states[0];
207  $this->assertTrue($contact->save());
208  $id = $contact->id;
209  $this->assertNotEmpty($id);
210  $contact->forget();
211 
212  Yii::app()->user->userModel = User::getByUsername('etester');
213  $contact = Contact::getById($id);
214  $this->assertNotEmpty($contact->id);
215  $this->assertEquals(Permission::NONE, $contact->account->getEffectivePermissions (Yii::app()->user->userModel));
216  }
217 
218  public function testLimitedUserCanCreateAccountHeDoesNotOwnAndThenCannotReadIt()
219  {
220  $super = User::getByUsername('super');
221  $limitedUser = UserTestHelper::createBasicUser('limitedMan');
222  Yii::app()->user->userModel = $limitedUser;
223  $account = new Account();
224  $account->name = 'limited';
225  $account->owner = $super;
226  $saved = $account->save();
227  $this->assertTrue($saved);
228  $this->assertEquals(Permission::NONE, $account->getEffectivePermissions($limitedUser));
229  }
230  }
231 ?>
static getAllModulePoliciesDataByPermitable(Permitable $permitable)
static getByUsername($username)
Definition: User.php:49
Definition: User.php:37
static loadFormFromCastedPost(PoliciesForm $form, array $validatedAndCastedPostData)
static setPoliciesFromCastedPost(array $validatedAndCastedPostData, $permitable)
static loadStartingData()
testRemovingGroupUserIsInAndRetrievingUserModulePermissions()
static typeCastPostData($postData)
static getAllModulePermissionsDataByPermitable(Permitable $permitable)
Definition: Group.php:37
static getByName($name)
Definition: Group.php:57
static makeFormFromPoliciesData($data)
static getById($id, $modelClassName=null)
testUserWhoCreatesModelAndGivesItAwayLosesAccessAndCantGetItBack()
Generated on Fri Jul 3 2020 07:10:37
Account Suspended
Account Suspended
This Account has been suspended.
Contact your hosting provider for more information.