Changeset 42976 for trunk/tests/phpunit/tests/multisite/wpmuValidateBlogSignup.php

Timestamp:

04/13/2018 03:29:52 PM (7 years ago)

Author:

flixos90

Message:

Multisite: Verify the signup nonce using wp_verify_nonce() in signup_nonce_check().

Prior to this change, the nonce passed from wp-signup.php was verified with a simple comparison. Furthermore in case of failures, wp_die() would be called right during the HTML markup being already printed. Now the error message is returned properly, modifying the WP_Error object in the passed $result.

Props herregroen.
Fixes #43667.

File:

• trunk/tests/phpunit/tests/multisite/wpmuValidateBlogSignup.php (modified) (1 diff)

trunk/tests/phpunit/tests/multisite/wpmuValidateBlogSignup.php

@@ -127 +127 @@
             return $this->minimum_site_name_length;
         }
+
+        /**
+         * @ticket 43667
+         */
+        public function test_signup_nonce_check() {
+            $original_php_self       = $_SERVER['PHP_SELF'];
+            $_SERVER['PHP_SELF']     = '/wp-signup.php';
+            $_POST['signup_form_id'] = 'blog-signup-form';
+            $_POST['_signup_form']   = wp_create_nonce( 'signup_form_' . $_POST['signup_form_id'] );
+
+            $valid               = wpmu_validate_blog_signup( 'my-nonce-site', 'Site Title', get_userdata( self::$super_admin_id ) );
+            $_SERVER['PHP_SELF'] = $original_php_self;
+
+            $this->assertNotContains( 'invalid_nonce', $valid['errors']->get_error_codes() );
+        }
+
+        /**
+         * @ticket 43667
+         */
+        public function test_signup_nonce_check_invalid() {
+            $original_php_self       = $_SERVER['PHP_SELF'];
+            $_SERVER['PHP_SELF']     = '/wp-signup.php';
+            $_POST['signup_form_id'] = 'blog-signup-form';
+            $_POST['_signup_form']   = wp_create_nonce( 'invalid' );
+
+            $valid               = wpmu_validate_blog_signup( 'my-nonce-site', 'Site Title', get_userdata( self::$super_admin_id ) );
+            $_SERVER['PHP_SELF'] = $original_php_self;
+
+            $this->assertContains( 'invalid_nonce', $valid['errors']->get_error_codes() );
+        }
     }