class UserPasswordResetTestCase

class UserPasswordResetTestCase extends DrupalWebTestCase {
  protected $profile = 'standard';
  public static function getInfo() {
    return array(
      'name' => 'Reset password',
      'description' => 'Ensure that password reset methods work as expected.',
      'group' => 'User',
    );
  }

  /**
   * Retrieves password reset email and extracts the login link.
   */
  public function getResetURL() {

    // Assume the most recent email.
    $_emails = $this
      ->drupalGetMails();
    $email = end($_emails);
    $urls = array();
    preg_match('#.+user/reset/.+#', $email['body'], $urls);
    return $urls[0];
  }

  /**
   * Tests password reset functionality.
   */
  function testUserPasswordReset() {

    // Create a user.
    $account = $this
      ->drupalCreateUser();
    $this
      ->drupalLogin($account);
    $this
      ->drupalLogout();

    // Attempt to reset password.
    $edit = array(
      'name' => $account->name,
    );
    $this
      ->drupalPost('user/password', $edit, t('E-mail new password'));

    // Confirm the password reset.
    $this
      ->assertText(t('Further instructions have been sent to your e-mail address.'), 'Password reset instructions mailed message displayed.');

    // Create an image field to enable an Ajax request on the user profile page.
    $field = array(
      'field_name' => 'field_avatar',
      'type' => 'image',
      'settings' => array(),
      'cardinality' => 1,
    );
    field_create_field($field);
    $instance = array(
      'field_name' => $field['field_name'],
      'entity_type' => 'user',
      'label' => 'Avatar',
      'bundle' => 'user',
      'required' => FALSE,
      'settings' => array(),
      'widget' => array(
        'type' => 'image_image',
        'settings' => array(),
      ),
    );
    field_create_instance($instance);
    $resetURL = $this
      ->getResetURL();
    $this
      ->drupalGet($resetURL);

    // Check successful login.
    $this
      ->drupalPost(NULL, NULL, t('Log in'));

    // Make sure the Ajax request from uploading a file does not invalidate the
    // reset token.
    $image = current($this
      ->drupalGetTestFiles('image'));
    $edit = array(
      'files[field_avatar_und_0]' => drupal_realpath($image->uri),
    );
    $this
      ->drupalPostAJAX(NULL, $edit, 'field_avatar_und_0_upload_button');

    // Change the forgotten password.
    $password = user_password();
    $edit = array(
      'pass[pass1]' => $password,
      'pass[pass2]' => $password,
    );
    $this
      ->drupalPost(NULL, $edit, t('Save'));
    $this
      ->assertText(t('The changes have been saved.'), 'Forgotten password changed.');
  }

  /**
   * Test user password reset while logged in.
   */
  function testUserPasswordResetLoggedIn() {
    $account = $this
      ->drupalCreateUser();
    $this
      ->drupalLogin($account);

    // Make sure the test account has a valid password.
    user_save($account, array(
      'pass' => user_password(),
    ));

    // Generate one time login link.
    $reset_url = user_pass_reset_url($account);
    $this
      ->drupalGet($reset_url);
    $this
      ->assertText('Reset password');
    $this
      ->drupalPost(NULL, NULL, t('Log in'));
    $this
      ->assertText('You have just used your one-time login link. It is no longer necessary to use this link to log in. Please change your password.');
    $pass = user_password();
    $edit = array(
      'pass[pass1]' => $pass,
      'pass[pass2]' => $pass,
    );
    $this
      ->drupalPost(NULL, $edit, t('Save'));
    $this
      ->assertText('The changes have been saved.');
  }

  /**
   * Attempts login using an expired password reset link.
   */
  function testUserPasswordResetExpired() {

    // Set password reset timeout variable to 43200 seconds = 12 hours.
    $timeout = 43200;
    variable_set('user_password_reset_timeout', $timeout);

    // Create a user.
    $account = $this
      ->drupalCreateUser();
    $this
      ->drupalLogin($account);

    // Load real user object.
    $account = user_load($account->uid, TRUE);
    $this
      ->drupalLogout();

    // To attempt an expired password reset, create a password reset link as if
    // its request time was 60 seconds older than the allowed limit of timeout.
    $bogus_timestamp = REQUEST_TIME - variable_get('user_password_reset_timeout', 86400) - 60;
    $this
      ->drupalGet("user/reset/{$account->uid}/{$bogus_timestamp}/" . user_pass_rehash($account->pass, $bogus_timestamp, $account->login, $account->uid));
    $this
      ->assertText(t('You have tried to use a one-time login link that has expired. Please request a new one using the form below.'), 'Expired password reset request rejected.');
  }

  /**
   * Prefill the text box on incorrect login via link to password reset page.
   */
  function testUserPasswordTextboxFilled() {
    $this
      ->drupalGet('user/login');
    $edit = array(
      'name' => $this
        ->randomName(),
      'pass' => $this
        ->randomName(),
    );
    $this
      ->drupalPost('user', $edit, t('Log in'));
    $this
      ->assertRaw(t('Sorry, unrecognized username or password. <a href="@password">Have you forgotten your password?</a>', array(
      '@password' => url('user/password', array(
        'query' => array(
          'name' => $edit['name'],
        ),
      )),
    )));
    unset($edit['pass']);
    $this
      ->drupalGet('user/password', array(
      'query' => array(
        'name' => $edit['name'],
      ),
    ));
    $this
      ->assertFieldByName('name', $edit['name'], 'User name found.');
  }

  /**
   * Make sure that users cannot forge password reset URLs of other users.
   */
  function testResetImpersonation() {

    // Make sure user 1 has a valid password, so it does not interfere with the
    // test user accounts that are created below.
    $account = user_load(1);
    user_save($account, array(
      'pass' => user_password(),
    ));

    // Create two identical user accounts except for the user name. They must
    // have the same empty password, so we can't use $this->drupalCreateUser().
    $edit = array();
    $edit['name'] = $this
      ->randomName();
    $edit['mail'] = $edit['name'] . '@example.com';
    $edit['status'] = 1;
    $user1 = user_save(drupal_anonymous_user(), $edit);
    $edit['name'] = $this
      ->randomName();
    $user2 = user_save(drupal_anonymous_user(), $edit);

    // The password reset URL must not be valid for the second user when only
    // the user ID is changed in the URL.
    $reset_url = user_pass_reset_url($user1);
    $attack_reset_url = str_replace("user/reset/{$user1->uid}", "user/reset/{$user2->uid}", $reset_url);
    $this
      ->drupalGet($attack_reset_url);
    $this
      ->assertNoText($user2->name, 'The invalid password reset page does not show the user name.');
    $this
      ->assertUrl('user/password', array(), 'The user is redirected to the password reset request page.');
    $this
      ->assertText('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.');

    // When legacy code calls user_pass_rehash() without providing the $uid
    // parameter, neither password reset URL should be valid since it is
    // impossible for the system to determine which user account the token was
    // intended for.
    $timestamp = REQUEST_TIME;

    // Pass an explicit NULL for the $uid parameter of user_pass_rehash()
    // rather than not passing it at all, to avoid triggering PHP warnings in
    // the test.
    $reset_url_token = user_pass_rehash($user1->pass, $timestamp, $user1->login, NULL);
    $reset_url = url("user/reset/{$user1->uid}/{$timestamp}/{$reset_url_token}", array(
      'absolute' => TRUE,
    ));
    $this
      ->drupalGet($reset_url);
    $this
      ->assertNoText($user1->name, 'The invalid password reset page does not show the user name.');
    $this
      ->assertUrl('user/password', array(), 'The user is redirected to the password reset request page.');
    $this
      ->assertText('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.');
    $attack_reset_url = str_replace("user/reset/{$user1->uid}", "user/reset/{$user2->uid}", $reset_url);
    $this
      ->drupalGet($attack_reset_url);
    $this
      ->assertNoText($user2->name, 'The invalid password reset page does not show the user name.');
    $this
      ->assertUrl('user/password', array(), 'The user is redirected to the password reset request page.');
    $this
      ->assertText('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.');

    // To verify that user_pass_rehash() never returns a valid result in the
    // above situation (even if legacy code also called it to attempt to
    // validate the token, rather than just to generate the URL), check that a
    // second call with the same parameters produces a different result.
    $new_reset_url_token = user_pass_rehash($user1->pass, $timestamp, $user1->login, NULL);
    $this
      ->assertNotEqual($reset_url_token, $new_reset_url_token);

    // However, when the duplicate account is removed, the password reset URL
    // should be valid.
    user_delete($user2->uid);
    $reset_url_token = user_pass_rehash($user1->pass, $timestamp, $user1->login, NULL);
    $reset_url = url("user/reset/{$user1->uid}/{$timestamp}/{$reset_url_token}", array(
      'absolute' => TRUE,
    ));
    $this
      ->drupalGet($reset_url);
    $this
      ->assertText($user1->name, 'The valid password reset page shows the user name.');
    $this
      ->assertUrl($reset_url, array(), 'The user remains on the password reset login page.');
    $this
      ->assertNoText('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.');
  }

}