Security update for Core, with self-updated composer

[yaffs-website] / web / core / modules / rest / tests / src / Functional / EntityResource / Term / TermResourceTestBase.php

diff --git a/web/core/modules/rest/tests/src/Functional/EntityResource/Term/TermResourceTestBase.php b/web/core/modules/rest/tests/src/Functional/EntityResource/Term/TermResourceTestBase.php
index 698451b58cf353948c7c7f0ed9dd628a11e2bad7..7b9ee5cdedc3f0a76678ce3934507831613c6fdd 100644 (file)
--- a/web/core/modules/rest/tests/src/Functional/EntityResource/Term/TermResourceTestBase.php
+++ b/web/core/modules/rest/tests/src/Functional/EntityResource/Term/TermResourceTestBase.php
@@ -4,14 +4,18 @@ namespace Drupal\Tests\rest\Functional\EntityResource\Term;
 
 use Drupal\taxonomy\Entity\Term;
 use Drupal\taxonomy\Entity\Vocabulary;
+use Drupal\Tests\rest\Functional\BcTimestampNormalizerUnixTestTrait;
 use Drupal\Tests\rest\Functional\EntityResource\EntityResourceTestBase;
+use GuzzleHttp\RequestOptions;
 
 abstract class TermResourceTestBase extends EntityResourceTestBase {
 
+  use BcTimestampNormalizerUnixTestTrait;
+
   /**
    * {@inheritdoc}
    */
-  public static $modules = ['taxonomy'];
+  public static $modules = ['taxonomy', 'path'];
 
   /**
    * {@inheritdoc}
@@ -41,8 +45,12 @@ abstract class TermResourceTestBase extends EntityResourceTestBase {
       case 'POST':
       case 'PATCH':
       case 'DELETE':
+        // Grant the 'create url aliases' permission to test the case when
+        // the path field is accessible, see
+        // \Drupal\Tests\rest\Functional\EntityResource\Node\NodeResourceTestBase
+        // for a negative test.
         // @todo Update once https://www.drupal.org/node/2824408 lands.
-        $this->grantPermissionsToTestedRole(['administer taxonomy']);
+        $this->grantPermissionsToTestedRole(['administer taxonomy', 'create url aliases']);
         break;
     }
   }
@@ -64,7 +72,8 @@ abstract class TermResourceTestBase extends EntityResourceTestBase {
     // Create a "Llama" taxonomy term.
     $term = Term::create(['vid' => $vocabulary->id()])
       ->setName('Llama')
-      ->setChangedTime(123456789);
+      ->setChangedTime(123456789)
+      ->set('path', '/llama');
     $term->save();
 
     return $term;
@@ -107,15 +116,20 @@ abstract class TermResourceTestBase extends EntityResourceTestBase {
         ],
       ],
       'changed' => [
-        [
-          'value' => $this->entity->getChangedTime(),
-        ],
+        $this->formatExpectedTimestampItemValues($this->entity->getChangedTime()),
       ],
       'default_langcode' => [
         [
           'value' => TRUE,
         ],
       ],
+      'path' => [
+        [
+          'alias' => '/llama',
+          'pid' => 1,
+          'langcode' => 'en',
+        ],
+      ],
     ];
   }
 
@@ -134,6 +148,12 @@ abstract class TermResourceTestBase extends EntityResourceTestBase {
           'value' => 'Dramallama',
         ],
       ],
+      'description' => [
+        [
+          'value' => 'Dramallamas are the coolest camelids.',
+          'format' => NULL,
+        ],
+      ],
     ];
   }
 
@@ -159,4 +179,48 @@ abstract class TermResourceTestBase extends EntityResourceTestBase {
     }
   }
 
+  /**
+   * Tests PATCHing a term's path.
+   *
+   * For a negative test, see the similar test coverage for Node.
+   *
+   * @see \Drupal\Tests\rest\Functional\EntityResource\Node\NodeResourceTestBase::testPatchPath()
+   */
+  public function testPatchPath() {
+    $this->initAuthentication();
+    $this->provisionEntityResource();
+    $this->setUpAuthorization('GET');
+    $this->setUpAuthorization('PATCH');
+
+    $url = $this->getEntityResourceUrl()->setOption('query', ['_format' => static::$format]);
+
+    // GET term's current normalization.
+    $response = $this->request('GET', $url, $this->getAuthenticationRequestOptions('GET'));
+    $normalization = $this->serializer->decode((string) $response->getBody(), static::$format);
+
+    // @todo In https://www.drupal.org/node/2824851, we will be able to stop
+    //       unsetting these fields from the normalization, because
+    //       EntityResource::patch() will ignore any fields that are sent that
+    //       match the current value (and obviously we're sending the current
+    //       value).
+    $normalization = $this->removeFieldsFromNormalization($normalization, [
+      'changed',
+    ]);
+
+    // Change term's path alias.
+    $normalization['path'][0]['alias'] .= 's-rule-the-world';
+
+    // Create term PATCH request.
+    $request_options = [];
+    $request_options[RequestOptions::HEADERS]['Content-Type'] = static::$mimeType;
+    $request_options = array_merge_recursive($request_options, $this->getAuthenticationRequestOptions('PATCH'));
+    $request_options[RequestOptions::BODY] = $this->serializer->encode($normalization, static::$format);
+
+    // PATCH request: 200.
+    $response = $this->request('PATCH', $url, $request_options);
+    $this->assertResourceResponse(200, FALSE, $response);
+    $updated_normalization = $this->serializer->decode((string) $response->getBody(), static::$format);
+    $this->assertSame($normalization['path'], $updated_normalization['path']);
+  }
+
 }