3 use MediaWiki\MediaWikiServices
;
4 use Wikimedia\TestingAccessWrapper
;
13 class ApiLoginTest
extends ApiTestCase
{
16 * Test result of attempted login with an empty username
18 public function testApiLoginNoName() {
20 'wsTokenSecrets' => [ 'login' => 'foobar' ],
22 $data = $this->doApiRequest( [ 'action' => 'login',
23 'lgname' => '', 'lgpassword' => self
::$users['sysop']->getPassword(),
24 'lgtoken' => (string)( new MediaWiki\Session\
Token( 'foobar', '' ) )
26 $this->assertEquals( 'Failed', $data[0]['login']['result'] );
29 public function testApiLoginBadPass() {
32 $user = self
::$users['sysop'];
33 $userName = $user->getUser()->getName();
34 $user->getUser()->logout();
36 if ( !isset( $wgServer ) ) {
37 $this->markTestIncomplete( 'This test needs $wgServer to be set in LocalSettings.php' );
39 $ret = $this->doApiRequest( [
41 "lgname" => $userName,
42 "lgpassword" => "bad",
47 $this->assertNotInternalType( "bool", $result );
48 $a = $result["login"]["result"];
49 $this->assertEquals( "NeedToken", $a );
51 $token = $result["login"]["token"];
53 $ret = $this->doApiRequest(
57 "lgname" => $userName,
58 "lgpassword" => "badnowayinhell",
65 $this->assertNotInternalType( "bool", $result );
66 $a = $result["login"]["result"];
68 $this->assertEquals( 'Failed', $a );
71 public function testApiLoginGoodPass() {
74 if ( !isset( $wgServer ) ) {
75 $this->markTestIncomplete( 'This test needs $wgServer to be set in LocalSettings.php' );
78 $user = self
::$users['sysop'];
79 $userName = $user->getUser()->getName();
80 $password = $user->getPassword();
81 $user->getUser()->logout();
83 $ret = $this->doApiRequest( [
85 "lgname" => $userName,
86 "lgpassword" => $password,
91 $this->assertNotInternalType( "bool", $result );
92 $this->assertNotInternalType( "null", $result["login"] );
94 $a = $result["login"]["result"];
95 $this->assertEquals( "NeedToken", $a );
96 $token = $result["login"]["token"];
98 $ret = $this->doApiRequest(
102 "lgname" => $userName,
103 "lgpassword" => $password,
110 $this->assertNotInternalType( "bool", $result );
111 $a = $result["login"]["result"];
113 $this->assertEquals( "Success", $a );
119 public function testApiLoginGotCookie() {
120 $this->markTestIncomplete( "The server can't do external HTTP requests, "
121 . "and the internal one won't give cookies" );
123 global $wgServer, $wgScriptPath;
125 if ( !isset( $wgServer ) ) {
126 $this->markTestIncomplete( 'This test needs $wgServer to be set in LocalSettings.php' );
128 $user = self
::$users['sysop'];
129 $userName = $user->getUser()->getName();
130 $password = $user->getPassword();
132 $req = MWHttpRequest
::factory( self
::$apiUrl . "?action=login&format=xml",
133 [ "method" => "POST",
135 "lgname" => $userName,
136 "lgpassword" => $password
143 libxml_use_internal_errors( true );
144 $sxe = simplexml_load_string( $req->getContent() );
145 $this->assertNotInternalType( "bool", $sxe );
146 $this->assertThat( $sxe, $this->isInstanceOf( SimpleXMLElement
::class ) );
147 $this->assertNotInternalType( "null", $sxe->login
[0] );
149 $a = $sxe->login
[0]->attributes()->result
[0];
150 $this->assertEquals( ' result="NeedToken"', $a->asXML() );
151 $token = (string)$sxe->login
[0]->attributes()->token
;
155 "lgname" => $userName,
156 "lgpassword" => $password ] );
159 $cj = $req->getCookieJar();
160 $serverName = parse_url( $wgServer, PHP_URL_HOST
);
161 $this->assertNotEquals( false, $serverName );
162 $serializedCookie = $cj->serializeToHttpRequest( $wgScriptPath, $serverName );
163 $this->assertNotEquals( '', $serializedCookie );
165 '/_session=[^;]*; .*UserID=[0-9]*; .*UserName=' . $user->userName
. '; .*Token=/',
170 public function testRunLogin() {
171 $user = self
::$users['sysop'];
172 $userName = $user->getUser()->getName();
173 $password = $user->getPassword();
175 $data = $this->doApiRequest( [
177 'lgname' => $userName,
178 'lgpassword' => $password ] );
180 $this->assertArrayHasKey( "login", $data[0] );
181 $this->assertArrayHasKey( "result", $data[0]['login'] );
182 $this->assertEquals( "NeedToken", $data[0]['login']['result'] );
183 $token = $data[0]['login']['token'];
185 $data = $this->doApiRequest( [
188 "lgname" => $userName,
189 "lgpassword" => $password ], $data[2] );
191 $this->assertArrayHasKey( "login", $data[0] );
192 $this->assertArrayHasKey( "result", $data[0]['login'] );
193 $this->assertEquals( "Success", $data[0]['login']['result'] );
196 public function testBotPassword() {
197 global $wgServer, $wgSessionProviders;
199 if ( !isset( $wgServer ) ) {
200 $this->markTestIncomplete( 'This test needs $wgServer to be set in LocalSettings.php' );
203 $this->setMwGlobals( [
204 'wgSessionProviders' => array_merge( $wgSessionProviders, [
206 'class' => MediaWiki\Session\BotPasswordSessionProvider
::class,
207 'args' => [ [ 'priority' => 40 ] ],
210 'wgEnableBotPasswords' => true,
211 'wgBotPasswordsDatabase' => false,
212 'wgCentralIdLookupProvider' => 'local',
213 'wgGrantPermissions' => [
214 'test' => [ 'read' => true ],
218 // Make sure our session provider is present
219 $manager = TestingAccessWrapper
::newFromObject( MediaWiki\Session\SessionManager
::singleton() );
220 if ( !isset( $manager->sessionProviders
[MediaWiki\Session\BotPasswordSessionProvider
::class] ) ) {
221 $tmp = $manager->sessionProviders
;
222 $manager->sessionProviders
= null;
223 $manager->sessionProviders
= $tmp +
$manager->getProviders();
225 $this->assertNotNull(
226 MediaWiki\Session\SessionManager
::singleton()->getProvider(
227 MediaWiki\Session\BotPasswordSessionProvider
::class
232 $user = self
::$users['sysop'];
233 $centralId = CentralIdLookup
::factory()->centralIdFromLocalUser( $user->getUser() );
234 $this->assertNotEquals( 0, $centralId, 'sanity check' );
236 $password = 'ngfhmjm64hv0854493hsj5nncjud2clk';
237 $passwordFactory = MediaWikiServices
::getInstance()->getPasswordFactory();
238 // A is unsalted MD5 (thus fast) ... we don't care about security here, this is test only
239 $passwordHash = $passwordFactory->newFromPlaintext( $password );
241 $dbw = wfGetDB( DB_MASTER
);
245 'bp_user' => $centralId,
246 'bp_app_id' => 'foo',
247 'bp_password' => $passwordHash->toString(),
249 'bp_restrictions' => MWRestrictions
::newDefault()->toJson(),
250 'bp_grants' => '["test"]',
255 $lgName = $user->getUser()->getName() . BotPassword
::getSeparator() . 'foo';
257 $ret = $this->doApiRequest( [
260 'lgpassword' => $password,
264 $this->assertNotInternalType( 'bool', $result );
265 $this->assertNotInternalType( 'null', $result['login'] );
267 $a = $result['login']['result'];
268 $this->assertEquals( 'NeedToken', $a );
269 $token = $result['login']['token'];
271 $ret = $this->doApiRequest( [
275 'lgpassword' => $password,
279 $this->assertNotInternalType( 'bool', $result );
280 $a = $result['login']['result'];
282 $this->assertEquals( 'Success', $a );
285 public function testLoginWithNoSameOriginSecurity() {
286 $this->setTemporaryHook( 'RequestHasSameOriginSecurity',
292 $result = $this->doApiRequest( [
297 'result' => 'Aborted',
298 'reason' => 'Cannot log in when the same-origin policy is not applied.',