Changeset 41163 for trunk/tests/phpunit/tests/user.php

Timestamp:

07/27/2017 02:09:51 AM (7 years ago)

Author:

johnbillion

Message:

Users: Require a confirmation link in an email to be clicked when a user attempts to change their email address.

This adds this previously Multisite-only functionality to single site installations too. This change prevents accidental or erroneous email address changes from potentially locking users out of their account.

Props rodrigosprimo, tharsheblows, johnbillion

Fixes #16470

File:

• trunk/tests/phpunit/tests/user.php (modified) (1 diff)

trunk/tests/phpunit/tests/user.php

@@ -1205 +1205 @@
         $pass1 = '';
     }
+
+    /**
+     * @ticket 16470
+     */
+    function test_send_confirmation_on_profile_email() {
+        reset_phpmailer_instance();
+        $was_confirmation_email_sent = false;
+
+        $user = $this->factory()->user->create_and_get( array(
+            'user_email' => 'before@example.com',
+        ) );
+
+        $_POST['email']   = 'after@example.com';
+        $_POST['user_id'] = $user->ID;
+
+        wp_set_current_user( $user->ID );
+
+        do_action( 'personal_options_update' );
+
+        if ( ! empty( $GLOBALS['phpmailer']->mock_sent ) ) {
+            $was_confirmation_email_sent = ( isset( $GLOBALS['phpmailer']->mock_sent[0] ) && 'after@example.com' == $GLOBALS['phpmailer']->mock_sent[0]['to'][0][0] );
+        }
+
+        // A confirmation email is sent.
+        $this->assertTrue( $was_confirmation_email_sent );
+
+        // The new email address gets put into user_meta.
+        $new_email_meta = get_user_meta( $user->ID, '_new_email', true );
+        $this->assertEquals( 'after@example.com', $new_email_meta['newemail'] );
+
+        // The email address of the user doesn't change. $_POST['email'] should be the email address pre-update.
+        $this->assertEquals( $_POST['email'], $user->user_email );
+    }
+
+    /**
+     * @ticket 16470
+     */
+    function test_remove_send_confirmation_on_profile_email() {
+        remove_action( 'personal_options_update', 'send_confirmation_on_profile_email' );
+
+        reset_phpmailer_instance();
+        $was_confirmation_email_sent = false;
+
+        $user = $this->factory()->user->create_and_get( array(
+            'user_email' => 'before@example.com',
+        ) );
+
+        $_POST['email']   = 'after@example.com';
+        $_POST['user_id'] = $user->ID;
+
+        wp_set_current_user( $user->ID );
+
+        do_action( 'personal_options_update' );
+
+        if ( ! empty( $GLOBALS['phpmailer']->mock_sent ) ) {
+            $was_confirmation_email_sent = ( isset( $GLOBALS['phpmailer']->mock_sent[0] ) && 'after@example.com' == $GLOBALS['phpmailer']->mock_sent[0]['to'][0][0] );
+        }
+
+        // No confirmation email is sent.
+        $this->assertFalse( $was_confirmation_email_sent );
+
+        // No usermeta is created.
+        $new_email_meta = get_user_meta( $user->ID, '_new_email', true );
+        $this->assertEmpty( $new_email_meta );
+
+        // $_POST['email'] should be the email address posted from the form.
+        $this->assertEquals( $_POST['email'], 'after@example.com' );
+    }
 }