jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Updated security expressions #148 (#166)

Browse Source 
* replace has_role() with is_granted()
* added basic integration test classes for main controller
* added basic integration test classes for admin controller
This commit is contained in:
Kevin Papst
2018-06-19 22:08:44 +02:00
committed by GitHub
parent 856e7ccaeb
commit 75a6bf3ef6
24 changed files with 465 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/Controller/ActivityController.php
View File

@@ -18,8 +18,7 @@ use App\Repository\ActivityRepository;
/**
* Controller used to manage activity contents in the public part of the site.
*
* @Route("/activity")
* @Security("has_role('ROLE_USER')")
* @Security("is_granted('ROLE_USER')")
*/
class ActivityController extends Controller
{

2
src/Controller/Admin/ActivityController.php
View File

@@ -25,7 +25,7 @@ use App\Repository\Query\ActivityQuery;
* Controller used to manage activities in the admin part of the site.
*
* @Route("/admin/activity")
* @Security("has_role('ROLE_ADMIN')")
* @Security("is_granted('ROLE_ADMIN')")
* @Security("is_granted('IS_AUTHENTICATED_FULLY')")
*/
class ActivityController extends AbstractController

2
src/Controller/Admin/CustomerController.php
View File

@@ -24,7 +24,7 @@ use App\Repository\Query\CustomerQuery;
* Controller used to manage activities in the admin part of the site.
*
* @Route("/admin/customer")
* @Security("has_role('ROLE_ADMIN')")
* @Security("is_granted('ROLE_ADMIN')")
* @Security("is_granted('IS_AUTHENTICATED_FULLY')")
*/
class CustomerController extends AbstractController

2
src/Controller/Admin/ProjectController.php
View File

@@ -26,7 +26,7 @@ use App\Repository\Query\ProjectQuery;
* Controller used to manage projects in the admin part of the site.
*
* @Route("/admin/project")
* @Security("has_role('ROLE_ADMIN')")
* @Security("is_granted('ROLE_ADMIN')")
* @Security("is_granted('IS_AUTHENTICATED_FULLY')")
*/
class ProjectController extends AbstractController

2
src/Controller/Admin/TimesheetController.php
View File

@@ -25,7 +25,7 @@ use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
* Controller used for manage timesheet entries in the admin part of the site.
*
* @Route("/team/timesheet")
* @Security("has_role('ROLE_TEAMLEAD')")
* @Security("is_granted('ROLE_TEAMLEAD')")
* @Security("is_granted('IS_AUTHENTICATED_FULLY')")
*/
class TimesheetController extends AbstractController

2
src/Controller/Admin/UserController.php
View File

@@ -24,7 +24,7 @@ use Symfony\Component\HttpFoundation\Request;
* Controller used to manage users in the admin part of the site.
*
* @Route("/admin/user")
* @Security("has_role('ROLE_SUPER_ADMIN')")
* @Security("is_granted('ROLE_SUPER_ADMIN')")
* @Security("is_granted('IS_AUTHENTICATED_FULLY')")
*/
class UserController extends AbstractController

2
src/Controller/DashboardController.php
View File

@@ -24,7 +24,7 @@ use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
* Dashboard controller for the admin area.
*
* @Route("/dashboard")
* @Security("has_role('ROLE_USER')")
* @Security("is_granted('ROLE_USER')")
*/
class DashboardController extends Controller
{

2
src/Controller/HelpController.php
View File

@@ -19,7 +19,7 @@ use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
* This controller can render the markdown documentation from /var/docs/
*
* @Route("/help")
* @Security("has_role('ROLE_USER')")
* @Security("is_granted('ROLE_USER')")
*/
class HelpController extends Controller
{

2
src/Controller/InvoiceController.php
View File

@@ -27,7 +27,7 @@ use Symfony\Component\HttpFoundation\Request;
* Controller used to manage invoices.
*
* @Route("/invoice")
* @Security("has_role('ROLE_TEAMLEAD')")
* @Security("is_granted('ROLE_TEAMLEAD')")
*/
class InvoiceController extends AbstractController
{

2
src/Controller/ProfileController.php
View File

@@ -27,7 +27,7 @@ use Symfony\Component\HttpFoundation\Request;
* User profile controller
*
* @Route("/profile")
* @Security("has_role('ROLE_USER')")
* @Security("is_granted('ROLE_USER')")
*/
class ProfileController extends AbstractController
{

2
src/Controller/SidebarController.php
View File

@@ -15,7 +15,7 @@ use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
/**
* Sidebar controller
*
* @Security("has_role('ROLE_USER')")
* @Security("is_granted('ROLE_USER')")
*/
class SidebarController extends AbstractController
{

2
src/Controller/TimesheetController.php
View File

@@ -25,7 +25,7 @@ use Symfony\Component\HttpFoundation\Request;
* Controller used to manage timesheet contents in the public part of the site.
*
* @Route("/timesheet")
* @Security("has_role('ROLE_USER')")
* @Security("is_granted('ROLE_USER')")
*/
class TimesheetController extends AbstractController
{

23
tests/Controller/ActivityControllerTest.php Normal file
View File

@@ -0,0 +1,23 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Tests\Controller;
/**
* @coversDefaultClass \App\Controller\ActivityController
* @group integration
*/
class ActivityControllerTest extends ControllerBaseTest
{
public function testIsSecure()
{
$this->markTestSkipped('no public route available');
}
}

34
tests/Controller/Admin/ActivityControllerTest.php Normal file
View File

@@ -0,0 +1,34 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Tests\Controller\Admin;
use App\Entity\User;
use App\Tests\Controller\ControllerBaseTest;
/**
* @coversDefaultClass \App\Controller\Admin\ActivityController
* @group integration
*/
class ActivityControllerTest extends ControllerBaseTest
{
public function testIsSecure()
{
$this->assertUrlIsSecured('/admin/activity/');
$this->assertUrlIsSecuredForRole(User::ROLE_TEAMLEAD, '/admin/activity/');
}
public function testIndexAction()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$this->assertAccessIsGranted($client, '/admin/activity/');
$this->assertHasDataTable($client);
}
}

34
tests/Controller/Admin/CustomerControllerTest.php Normal file
View File

@@ -0,0 +1,34 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Tests\Controller\Admin;
use App\Entity\User;
use App\Tests\Controller\ControllerBaseTest;
/**
* @coversDefaultClass \App\Controller\Admin\CustomerController
* @group integration
*/
class CustomerControllerTest extends ControllerBaseTest
{
public function testIsSecure()
{
$this->assertUrlIsSecured('/admin/customer/');
$this->assertUrlIsSecuredForRole(User::ROLE_TEAMLEAD, '/admin/customer/');
}
public function testIndexAction()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$this->assertAccessIsGranted($client, '/admin/customer/');
$this->assertHasDataTable($client);
}
}

34
tests/Controller/Admin/ProjectControllerTest.php Normal file
View File

@@ -0,0 +1,34 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Tests\Controller\Admin;
use App\Entity\User;
use App\Tests\Controller\ControllerBaseTest;
/**
* @coversDefaultClass \App\Controller\Admin\ProjectController
* @group integration
*/
class ProjectControllerTest extends ControllerBaseTest
{
public function testIsSecure()
{
$this->assertUrlIsSecured('/admin/project/');
$this->assertUrlIsSecuredForRole(User::ROLE_TEAMLEAD, '/admin/project/');
}
public function testIndexAction()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_ADMIN);
$this->assertAccessIsGranted($client, '/admin/project/');
$this->assertHasDataTable($client);
}
}

34
tests/Controller/Admin/TimesheetControllerTest.php Normal file
View File

@@ -0,0 +1,34 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Tests\Controller\Admin;
use App\Entity\User;
use App\Tests\Controller\ControllerBaseTest;
/**
* @coversDefaultClass \App\Controller\Admin\TimesheetController
* @group integration
*/
class TimesheetControllerTest extends ControllerBaseTest
{
public function testIsSecure()
{
$this->assertUrlIsSecured('/team/timesheet/');
$this->assertUrlIsSecuredForRole(User::ROLE_USER, '/team/timesheet/');
}
public function testIndexAction()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_TEAMLEAD);
$this->assertAccessIsGranted($client, '/team/timesheet/');
$this->assertHasDataTable($client);
}
}

34
tests/Controller/Admin/UserControllerTest.php Normal file
View File

@@ -0,0 +1,34 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Tests\Controller\Admin;
use App\Entity\User;
use App\Tests\Controller\ControllerBaseTest;
/**
* @coversDefaultClass \App\Controller\Admin\UserController
* @group integration
*/
class UserControllerTest extends ControllerBaseTest
{
public function testIsSecure()
{
$this->assertUrlIsSecured('/admin/user/');
$this->assertUrlIsSecuredForRole(User::ROLE_ADMIN, '/admin/user/');
}
public function testIndexAction()
{
$client = $this->getClientForAuthenticatedUser(User::ROLE_SUPER_ADMIN);
$this->assertAccessIsGranted($client, '/admin/user/');
$this->assertHasDataTable($client);
}
}

107
tests/Controller/ControllerBaseTest.php
View File

@@ -10,6 +10,7 @@
namespace App\Tests\Controller;
use App\DataFixtures\AppFixtures;
use App\Entity\User;
use Symfony\Bundle\FrameworkBundle\Client;
use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
@@ -22,14 +23,44 @@ abstract class ControllerBaseTest extends WebTestCase
const DEFAULT_LANGUAGE = 'en';
/**
* @param string $role
* @return Client
*/
protected function getClientForAuthenticatedUser()
protected function getClientForAuthenticatedUser(string $role = User::ROLE_USER)
{
$client = self::createClient([], [
'PHP_AUTH_USER' => AppFixtures::USERNAME_USER,
'PHP_AUTH_PW' => AppFixtures::DEFAULT_PASSWORD,
]);
switch($role) {
case User::ROLE_SUPER_ADMIN:
$client = self::createClient([], [
'PHP_AUTH_USER' => AppFixtures::USERNAME_SUPER_ADMIN,
'PHP_AUTH_PW' => AppFixtures::DEFAULT_PASSWORD,
]);
break;
case User::ROLE_ADMIN:
$client = self::createClient([], [
'PHP_AUTH_USER' => AppFixtures::USERNAME_ADMIN,
'PHP_AUTH_PW' => AppFixtures::DEFAULT_PASSWORD,
]);
break;
case User::ROLE_TEAMLEAD:
$client = self::createClient([], [
'PHP_AUTH_USER' => AppFixtures::USERNAME_TEAMLEAD,
'PHP_AUTH_PW' => AppFixtures::DEFAULT_PASSWORD,
]);
break;
case User::ROLE_USER:
$client = self::createClient([], [
'PHP_AUTH_USER' => AppFixtures::USERNAME_USER,
'PHP_AUTH_PW' => AppFixtures::DEFAULT_PASSWORD,
]);
break;
default:
$client = null;
break;
}
return $client;
}
@@ -46,23 +77,64 @@ abstract class ControllerBaseTest extends WebTestCase
}
/**
* @param Client $client
* @param string $url
* @param string $method
*/
protected function assertUrlIsSecured(string $url, $method = 'GET')
protected function assertRequestIsSecured(Client $client, string $url, $method = 'GET')
{
$client = self::createClient();
$client->request($method, '/' . self::DEFAULT_LANGUAGE . $url);
$this->assertTrue($client->getResponse()->isRedirect());
$this->assertTrue(
$client->getResponse()->isRedirect(),
sprintf('The secure URL %s is not protected.', $url . $client->getResponse()->getContent())
);
$this->assertEquals(
'http://localhost/' . self::DEFAULT_LANGUAGE . '/login',
$client->getResponse()->getTargetUrl(),
sprintf('The %s secure URL redirects to the login form.', $url)
sprintf('The secure URL %s does not redirect to the login form.', $url)
);
}
/**
* @param string $url
* @param string $method
* @param Client|null $client
*/
protected function assertUrlIsSecured(string $url, $method = 'GET')
{
$client = self::createClient();
$this->assertRequestIsSecured($client, $url, $method);
}
/**
* @param string $role
* @param string $url
* @param string $method
*/
protected function assertUrlIsSecuredForRole(string $role, string $url, string $method = 'GET')
{
$client = $this->getClientForAuthenticatedUser($role);
$client->request($method, '/' . self::DEFAULT_LANGUAGE . $url);
$this->assertFalse(
$client->getResponse()->isSuccessful(),
sprintf('The secure URL %s is not protected for role %s', $url, $role)
);
$this->assertContains('Symfony\Component\Security\Core\Exception\AccessDeniedException', $client->getResponse()->getContent());
}
/**
* @param Client $client
* @param string $url
*/
protected function assertAccessIsGranted(Client $client, $url)
{
$this->request($client, $url);
$this->assertTrue($client->getResponse()->isSuccessful());
// TODO improve this test?
}
/**
* @param Client $client
*/
@@ -71,4 +143,21 @@ abstract class ControllerBaseTest extends WebTestCase
$this->assertFalse($client->getResponse()->isSuccessful());
$this->assertEquals(404, $client->getResponse()->getStatusCode());
}
/**
* @param Client $client
* @param string $classname
*/
protected function assertMainContentClass(Client $client, $classname)
{
$this->assertContains('<section class="content '.$classname.'">', $client->getResponse()->getContent());
}
/**
* @param Client $client
*/
protected function assertHasDataTable(Client $client)
{
$this->assertContains('<table class="table table-striped table-hover dataTable" role="grid">', $client->getResponse()->getContent());
}
}

31
tests/Controller/DashboardControllerTest.php Normal file
View File

@@ -0,0 +1,31 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Tests\Controller;
/**
* @coversDefaultClass \App\Controller\DashboardController
* @group integration
*/
class DashboardControllerTest extends ControllerBaseTest
{
public function testIsSecure()
{
$this->assertUrlIsSecured('/dashboard/');
}
public function testIndexAction()
{
$client = $this->getClientForAuthenticatedUser();
$this->request($client, '/dashboard/');
$this->assertTrue($client->getResponse()->isSuccessful());
$this->assertMainContentClass($client, 'dashboard');
}
}

35
tests/Controller/InvoiceControllerTest.php Normal file
View File

@@ -0,0 +1,35 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Tests\Controller;
use App\Entity\User;
/**
* @coversDefaultClass \App\Controller\InvoiceController
* @group integration
*/
class InvoiceControllerTest extends ControllerBaseTest
{
public function testIsSecure()
{
$this->assertUrlIsSecured('/invoice/');
$this->assertUrlIsSecuredForRole(User::ROLE_USER, '/invoice/');
}
public function testIndexAction()
{
$this->markTestSkipped('create invoice template before this test case');
$client = $this->getClientForAuthenticatedUser(User::ROLE_TEAMLEAD);
$this->request($client, '/invoice/');
$this->assertTrue($client->getResponse()->isSuccessful());
$this->assertMainContentClass($client, 'dashboard');
}
}

40
tests/Controller/ProfileControllerTest.php Normal file
View File

@@ -0,0 +1,40 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Tests\Controller;
use App\DataFixtures\AppFixtures;
use App\Entity\User;
/**
* @coversDefaultClass \App\Controller\InvoiceController
* @group integration
*/
class ProfileControllerTest extends ControllerBaseTest
{
public function testIsSecure()
{
$this->assertUrlIsSecured('/profile/' . AppFixtures::USERNAME_USER);
}
public function testIndexAction()
{
$client = $this->getClientForAuthenticatedUser();
$this->request($client, '/profile/' . AppFixtures::USERNAME_USER);
$this->assertTrue($client->getResponse()->isSuccessful());
}
public function testIndexActionWithDifferentUsername()
{
$client = $this->getClientForAuthenticatedUser();
$this->request($client, '/profile/' . AppFixtures::USERNAME_TEAMLEAD);
$this->assertFalse($client->getResponse()->isSuccessful());
}
}

23
tests/Controller/SidebarControllerTest.php Normal file
View File

@@ -0,0 +1,23 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Tests\Controller;
/**
* @coversDefaultClass \App\Controller\SidebarController
* @group integration
*/
class SidebarControllerTest extends ControllerBaseTest
{
public function testIsSecure()
{
$this->markTestSkipped('no public route available');
}
}

33
tests/Controller/TimesheetControllerTest.php Normal file
View File

@@ -0,0 +1,33 @@
<?php
/*
* This file is part of the Kimai time-tracking app.
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace App\Tests\Controller;
use App\DataFixtures\AppFixtures;
use App\Entity\User;
/**
* @coversDefaultClass \App\Controller\TimesheetController
* @group integration
*/
class TimesheetControllerTest extends ControllerBaseTest
{
public function testIsSecure()
{
$this->assertUrlIsSecured('/timesheet/');
}
public function testIndexAction()
{
$client = $this->getClientForAuthenticatedUser();
$this->request($client, '/timesheet/');
$this->assertTrue($client->getResponse()->isSuccessful());
}
}