Skip to content

Commit 54a95a5

Browse files
AntonV1211AntonV1211
committed
Tests phpunits
1 parent 8767989 commit 54a95a5

File tree

1 file changed

+297
-0
lines changed

1 file changed

+297
-0
lines changed

‎tests/Inc/TestSettingsCapabilityCheck.php‎

Lines changed: 297 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,297 @@
1+
<?php
2+
namespace Inc;
3+
4+
use Cleantalk\ApbctWP\State;
5+
use Cleantalk\ApbctWP\Variables\Post;
6+
use Cleantalk\ApbctWP\Variables\Request;
7+
use PHPUnit\Framework\TestCase;
8+
9+
/**
10+
* Tests for capability checks in settings AJAX handlers.
11+
* Verifies that functions properly check current_user_can('activate_plugins').
12+
*/
13+
class TestSettingsCapabilityCheck extends TestCase
14+
{
15+
/**
16+
* @var int User ID for subscriber (no activate_plugins capability)
17+
*/
18+
private static $subscriber_id;
19+
20+
/**
21+
* @var int User ID for administrator (has activate_plugins capability)
22+
*/
23+
private static $admin_id;
24+
25+
/**
26+
* @var mixed Backup of global $apbct
27+
*/
28+
private $apbctBackup;
29+
30+
/**
31+
* @var string Path to the settings file
32+
*/
33+
private $settingsFilePath;
34+
35+
public static function setUpBeforeClass(): void
36+
{
37+
// Create a subscriber user (no activate_plugins capability)
38+
self::$subscriber_id = wp_insert_user([
39+
'user_login' => 'test_subscriber_' . wp_generate_password(6, false),
40+
'user_pass' => wp_generate_password(),
41+
'user_email' => 'subscriber_' . wp_generate_password(6, false) . '@test.com',
42+
'role' => 'subscriber',
43+
]);
44+
45+
// Create an administrator user (has activate_plugins capability)
46+
self::$admin_id = wp_insert_user([
47+
'user_login' => 'test_admin_' . wp_generate_password(6, false),
48+
'user_pass' => wp_generate_password(),
49+
'user_email' => 'admin_' . wp_generate_password(6, false) . '@test.com',
50+
'role' => 'administrator',
51+
]);
52+
}
53+
54+
public static function tearDownAfterClass(): void
55+
{
56+
// Clean up users
57+
if (self::$subscriber_id && !is_wp_error(self::$subscriber_id)) {
58+
wp_delete_user(self::$subscriber_id);
59+
}
60+
if (self::$admin_id && !is_wp_error(self::$admin_id)) {
61+
wp_delete_user(self::$admin_id);
62+
}
63+
64+
Post::getInstance()->variables = [];
65+
Request::getInstance()->variables = [];
66+
$_POST = [];
67+
$_REQUEST = [];
68+
}
69+
70+
protected function setUp(): void
71+
{
72+
global $apbct;
73+
$this->apbctBackup = $apbct;
74+
$apbct = new State('cleantalk', array('settings', 'data', 'errors', 'remote_calls', 'stats', 'fw_stats'));
75+
$this->settingsFilePath = CLEANTALK_PLUGIN_DIR . 'inc/cleantalk-settings.php';
76+
}
77+
78+
protected function tearDown(): void
79+
{
80+
global $apbct;
81+
$apbct = $this->apbctBackup;
82+
83+
// Reset current user
84+
wp_set_current_user(0);
85+
86+
// Clear POST/REQUEST
87+
Post::getInstance()->variables = [];
88+
Request::getInstance()->variables = [];
89+
$_POST = [];
90+
$_REQUEST = [];
91+
}
92+
93+
/**
94+
* Test that administrator has activate_plugins capability
95+
*/
96+
public function testAdminHasActivatePluginsCapability()
97+
{
98+
wp_set_current_user(self::$admin_id);
99+
100+
$this->assertTrue(
101+
current_user_can('activate_plugins'),
102+
'Administrator should have activate_plugins capability'
103+
);
104+
}
105+
106+
/**
107+
* Test that subscriber does NOT have activate_plugins capability
108+
*/
109+
public function testSubscriberDoesNotHaveActivatePluginsCapability()
110+
{
111+
wp_set_current_user(self::$subscriber_id);
112+
113+
$this->assertFalse(
114+
current_user_can('activate_plugins'),
115+
'Subscriber should NOT have activate_plugins capability'
116+
);
117+
}
118+
119+
/**
120+
* Test that anonymous user does NOT have activate_plugins capability
121+
*/
122+
public function testAnonymousDoesNotHaveActivatePluginsCapability()
123+
{
124+
wp_set_current_user(0);
125+
126+
$this->assertFalse(
127+
current_user_can('activate_plugins'),
128+
'Anonymous user should NOT have activate_plugins capability'
129+
);
130+
}
131+
132+
/**
133+
* Test that apbct_settings__check_renew_banner contains capability check
134+
*/
135+
public function testCheckRenewBannerHasCapabilityCheck()
136+
{
137+
$this->assertFunctionHasCapabilityCheck(
138+
'apbct_settings__check_renew_banner',
139+
'apbct_settings__check_renew_banner should contain current_user_can(\'activate_plugins\') check'
140+
);
141+
}
142+
143+
/**
144+
* Test that apbct_settings__get__long_description contains capability check
145+
*/
146+
public function testGetLongDescriptionHasCapabilityCheck()
147+
{
148+
$this->assertFunctionHasCapabilityCheck(
149+
'apbct_settings__get__long_description',
150+
'apbct_settings__get__long_description should contain current_user_can(\'activate_plugins\') check'
151+
);
152+
}
153+
154+
/**
155+
* Test that apbct_settings__get_key_auto contains capability check
156+
*/
157+
public function testGetKeyAutoHasCapabilityCheck()
158+
{
159+
$this->assertFunctionHasCapabilityCheck(
160+
'apbct_settings__get_key_auto',
161+
'apbct_settings__get_key_auto should contain current_user_can(\'activate_plugins\') check'
162+
);
163+
}
164+
165+
/**
166+
* Helper method to check if a function contains capability check
167+
*
168+
* @param string $functionName Function name to check
169+
* @param string $message Assertion message
170+
*/
171+
private function assertFunctionHasCapabilityCheck($functionName, $message)
172+
{
173+
$fileContent = file_get_contents($this->settingsFilePath);
174+
175+
// Find the function definition
176+
$pattern = '/function\s+' . preg_quote($functionName, '/') . '\s*\([^)]*\)\s*\{/';
177+
$this->assertRegExp($pattern, $fileContent, "Function $functionName should exist");
178+
179+
// Extract function body
180+
$functionBody = $this->extractFunctionBody($fileContent, $functionName);
181+
$this->assertNotEmpty($functionBody, "Could not extract function body for $functionName");
182+
183+
// Check for capability check
184+
$hasCapabilityCheck = strpos($functionBody, "current_user_can('activate_plugins')") !== false
185+
|| strpos($functionBody, 'current_user_can("activate_plugins")') !== false;
186+
187+
$this->assertTrue($hasCapabilityCheck, $message);
188+
189+
// Check that it returns/dies on failure
190+
$hasProperHandling = strpos($functionBody, 'die(') !== false
191+
|| strpos($functionBody, 'wp_die(') !== false
192+
|| strpos($functionBody, 'return') !== false;
193+
194+
$this->assertTrue(
195+
$hasProperHandling,
196+
"$functionName should terminate or return on capability check failure"
197+
);
198+
}
199+
200+
/**
201+
* Extract function body from file content
202+
*
203+
* @param string $fileContent Full file content
204+
* @param string $functionName Function name
205+
* @return string Function body
206+
*/
207+
private function extractFunctionBody($fileContent, $functionName)
208+
{
209+
$pattern = '/function\s+' . preg_quote($functionName, '/') . '\s*\([^)]*\)\s*\{/';
210+
211+
if (!preg_match($pattern, $fileContent, $matches, PREG_OFFSET_CAPTURE)) {
212+
return '';
213+
}
214+
215+
$startPos = $matches[0][1];
216+
$braceCount = 0;
217+
$inFunction = false;
218+
$functionBody = '';
219+
220+
for ($i = $startPos; $i < strlen($fileContent); $i++) {
221+
$char = $fileContent[$i];
222+
223+
if ($char === '{') {
224+
$braceCount++;
225+
$inFunction = true;
226+
} elseif ($char === '}') {
227+
$braceCount--;
228+
}
229+
230+
if ($inFunction) {
231+
$functionBody .= $char;
232+
}
233+
234+
if ($inFunction && $braceCount === 0) {
235+
break;
236+
}
237+
}
238+
239+
return $functionBody;
240+
}
241+
242+
/**
243+
* Test capability check logic works correctly for subscriber
244+
* This verifies that when a subscriber makes the check, it returns false
245+
*/
246+
public function testCapabilityCheckLogicForSubscriber()
247+
{
248+
wp_set_current_user(self::$subscriber_id);
249+
250+
// Simulate the check that is in the functions
251+
$hasCapability = current_user_can('activate_plugins');
252+
253+
$this->assertFalse(
254+
$hasCapability,
255+
'Capability check should return false for subscriber, blocking access'
256+
);
257+
}
258+
259+
/**
260+
* Test capability check logic works correctly for admin
261+
* This verifies that when an admin makes the check, it returns true
262+
*/
263+
public function testCapabilityCheckLogicForAdmin()
264+
{
265+
wp_set_current_user(self::$admin_id);
266+
267+
// Simulate the check that is in the functions
268+
$hasCapability = current_user_can('activate_plugins');
269+
270+
$this->assertTrue(
271+
$hasCapability,
272+
'Capability check should return true for admin, allowing access'
273+
);
274+
}
275+
276+
/**
277+
* Test that editor role does NOT have activate_plugins capability
278+
*/
279+
public function testEditorDoesNotHaveActivatePluginsCapability()
280+
{
281+
$editor_id = wp_insert_user([
282+
'user_login' => 'test_editor_' . wp_generate_password(6, false),
283+
'user_pass' => wp_generate_password(),
284+
'user_email' => 'editor_' . wp_generate_password(6, false) . '@test.com',
285+
'role' => 'editor',
286+
]);
287+
288+
wp_set_current_user($editor_id);
289+
290+
$this->assertFalse(
291+
current_user_can('activate_plugins'),
292+
'Editor should NOT have activate_plugins capability'
293+
);
294+
295+
wp_delete_user($editor_id);
296+
}
297+
}

0 commit comments

Comments
 (0)