X-Git-Url: http://www.aleph1.co.uk/gitweb/?a=blobdiff_plain;f=web%2Fcore%2Fmodules%2Fsystem%2Fsrc%2FTests%2FSystem%2FPageTitleTest.php;fp=web%2Fcore%2Fmodules%2Fsystem%2Fsrc%2FTests%2FSystem%2FPageTitleTest.php;h=3b4d38a500f6fbf55516ffa4151ece98514fda9d;hb=a2bd1bf0c2c1f1a17d188f4dc0726a45494cefae;hp=0000000000000000000000000000000000000000;hpb=57c063afa3f66b07c4bbddc2d6129a96d90f0aad;p=yaffs-website

diff --git a/web/core/modules/system/src/Tests/System/PageTitleTest.php b/web/core/modules/system/src/Tests/System/PageTitleTest.php
new file mode 100644
index 000000000..3b4d38a50
--- /dev/null
+++ b/web/core/modules/system/src/Tests/System/PageTitleTest.php
@@ -0,0 +1,145 @@
+<?php
+
+namespace Drupal\system\Tests\System;
+
+use Drupal\Component\Utility\Html;
+use Drupal\Component\Utility\Xss;
+use Drupal\simpletest\WebTestBase;
+
+/**
+ * Tests HTML output escaping of page title, site name, and slogan.
+ *
+ * @group system
+ */
+class PageTitleTest extends WebTestBase {
+
+  /**
+   * Modules to enable.
+   *
+   * @var array
+   */
+  public static $modules = ['node', 'test_page_test', 'form_test', 'block'];
+
+  protected $contentUser;
+  protected $savedTitle;
+
+  /**
+   * Implement setUp().
+   */
+  protected function setUp() {
+    parent::setUp();
+
+    $this->drupalCreateContentType(['type' => 'page', 'name' => 'Basic page']);
+
+    $this->drupalPlaceBlock('page_title_block');
+
+    $this->contentUser = $this->drupalCreateUser(['create page content', 'access content', 'administer themes', 'administer site configuration', 'link to any page']);
+    $this->drupalLogin($this->contentUser);
+  }
+
+  /**
+   * Tests the handling of HTML in node titles.
+   */
+  public function testTitleTags() {
+    $title = "string with <em>HTML</em>";
+    // Generate node content.
+    $edit = [
+      'title[0][value]' => '!SimpleTest! ' . $title . $this->randomMachineName(20),
+      'body[0][value]' => '!SimpleTest! test body' . $this->randomMachineName(200),
+    ];
+    // Create the node with HTML in the title.
+    $this->drupalPostForm('node/add/page', $edit, t('Save'));
+
+    $node = $this->drupalGetNodeByTitle($edit['title[0][value]']);
+    $this->assertNotNull($node, 'Node created and found in database');
+    $this->assertText(Html::escape($edit['title[0][value]']), 'Check to make sure tags in the node title are converted.');
+    $this->drupalGet("node/" . $node->id());
+    $this->assertText(Html::escape($edit['title[0][value]']), 'Check to make sure tags in the node title are converted.');
+  }
+
+  /**
+   * Test if the title of the site is XSS proof.
+   */
+  public function testTitleXSS() {
+    // Set some title with JavaScript and HTML chars to escape.
+    $title = '</title><script type="text/javascript">alert("Title XSS!");</script> & < > " \' ';
+    $title_filtered = Html::escape($title);
+
+    $slogan = '<script type="text/javascript">alert("Slogan XSS!");</script>';
+    $slogan_filtered = Xss::filterAdmin($slogan);
+
+    // Set title and slogan.
+    $edit = [
+      'site_name'    => $title,
+      'site_slogan'  => $slogan,
+    ];
+    $this->drupalPostForm('admin/config/system/site-information', $edit, t('Save configuration'));
+
+    // Place branding block with site name and slogan into header region.
+    $this->drupalPlaceBlock('system_branding_block', ['region' => 'header']);
+
+    // Load frontpage.
+    $this->drupalGet('');
+
+    // Test the title.
+    $this->assertNoRaw($title, 'Check for the lack of the unfiltered version of the title.');
+    // Add </title> to make sure we're checking the title tag, rather than the
+    // first 'heading' on the page.
+    $this->assertRaw($title_filtered . '</title>', 'Check for the filtered version of the title in a <title> tag.');
+
+    // Test the slogan.
+    $this->assertNoRaw($slogan, 'Check for the unfiltered version of the slogan.');
+    $this->assertRaw($slogan_filtered, 'Check for the filtered version of the slogan.');
+  }
+
+  /**
+   * Tests the page title of render arrays.
+   *
+   * @see \Drupal\test_page_test\Controller\Test
+   */
+  public function testRoutingTitle() {
+    // Test the '#title' render array attribute.
+    $this->drupalGet('test-render-title');
+
+    $this->assertTitle('Foo | Drupal');
+    $result = $this->xpath('//h1[@class="page-title"]');
+    $this->assertEqual('Foo', (string) $result[0]);
+
+    // Test forms
+    $this->drupalGet('form-test/object-builder');
+
+    $this->assertTitle('Test dynamic title | Drupal');
+    $result = $this->xpath('//h1[@class="page-title"]');
+    $this->assertEqual('Test dynamic title', (string) $result[0]);
+
+    // Set some custom translated strings.
+    $this->addCustomTranslations('en', ['' => [
+      'Static title' => 'Static title translated'
+    ]]);
+    $this->writeCustomTranslations();
+
+    // Ensure that the title got translated.
+    $this->drupalGet('test-page-static-title');
+
+    $this->assertTitle('Static title translated | Drupal');
+    $result = $this->xpath('//h1[@class="page-title"]');
+    $this->assertEqual('Static title translated', (string) $result[0]);
+
+    // Test the dynamic '_title_callback' route option.
+    $this->drupalGet('test-page-dynamic-title');
+
+    $this->assertTitle('Dynamic title | Drupal');
+    $result = $this->xpath('//h1[@class="page-title"]');
+    $this->assertEqual('Dynamic title', (string) $result[0]);
+
+    // Ensure that titles are cacheable and are escaped normally if the
+    // controller does not escape them.
+    $this->drupalGet('test-page-cached-controller');
+    $this->assertTitle('Cached title | Drupal');
+    $this->assertRaw(Html::escape('<span>Cached title</span>') . '</h1>');
+    $this->drupalGet('test-page-cached-controller');
+    $this->assertTitle('Cached title | Drupal');
+    $this->assertRaw(Html::escape('<span>Cached title</span>') . '</h1>');
+  }
+
+}