Security update for Core, with self-updated composer

[yaffs-website] / web / core / modules / rest / tests / src / Functional / ResourceTestBase.php

diff --git a/web/core/modules/rest/tests/src/Functional/ResourceTestBase.php b/web/core/modules/rest/tests/src/Functional/ResourceTestBase.php
index c9e4c443ebd1a7beb1342640c7c12f4554eb7b86..0a0e34c35d408487aa26ad409f7ff98b43e559d4 100644 (file)
--- a/web/core/modules/rest/tests/src/Functional/ResourceTestBase.php
+++ b/web/core/modules/rest/tests/src/Functional/ResourceTestBase.php
@@ -62,6 +62,8 @@ abstract class ResourceTestBase extends BrowserTestBase {
    * The REST Resource plugin ID can be calculated from this.
    *
    * @var string
+   *
+   * @see \Drupal\rest\Entity\RestResourceConfig::__construct()
    */
   protected static $resourceConfigId = NULL;
 
@@ -99,6 +101,8 @@ abstract class ResourceTestBase extends BrowserTestBase {
   public function setUp() {
     parent::setUp();
 
+    $this->serializer = $this->container->get('serializer');
+
     // Ensure the anonymous user role has no permissions at all.
     $user_role = Role::load(RoleInterface::ANONYMOUS_ID);
     foreach ($user_role->getPermissions() as $permission) {
@@ -172,6 +176,21 @@ abstract class ResourceTestBase extends BrowserTestBase {
     \Drupal::service('router.builder')->rebuildIfNeeded();
   }
 
+  /**
+   * Return the expected error message.
+   *
+   * @param string $method
+   *   The HTTP method (GET, POST, PATCH, DELETE).
+   *
+   * @return string
+   *   The error string.
+   */
+  protected function getExpectedUnauthorizedAccessMessage($method) {
+    $resource_plugin_id = str_replace('.', ':', static::$resourceConfigId);
+    $permission = 'restful ' . strtolower($method) . ' ' . $resource_plugin_id;
+    return "The '$permission' permission is required.";
+  }
+
   /**
    * Sets up the necessary authorization.
    *
@@ -230,29 +249,6 @@ abstract class ResourceTestBase extends BrowserTestBase {
    */
   abstract protected function assertAuthenticationEdgeCases($method, Url $url, array $request_options);
 
-  /**
-   * Return the expected error message.
-   *
-   * @param string $method
-   *   The HTTP method (GET, POST, PATCH, DELETE).
-   *
-   * @return string
-   *    The error string.
-   */
-  abstract protected function getExpectedUnauthorizedAccessMessage($method);
-
-  /**
-   * Return the default expected error message if the
-   * bc_entity_resource_permissions is true.
-   *
-   * @param string $method
-   *   The HTTP method (GET, POST, PATCH, DELETE).
-   *
-   * @return string
-   *   The error string.
-   */
-  abstract protected function getExpectedBcUnauthorizedAccessMessage($method);
-
   /**
    * Initializes authentication.
    *
@@ -321,6 +317,9 @@ abstract class ResourceTestBase extends BrowserTestBase {
    * 'http_errors = FALSE' request option, nor do we want them to have to
    * convert Drupal Url objects to strings.
    *
+   * We also don't want to follow redirects automatically, to ensure these tests
+   * are able to detect when redirects are added or removed.
+   *
    * @see \GuzzleHttp\ClientInterface::request()
    *
    * @param string $method
@@ -334,6 +333,7 @@ abstract class ResourceTestBase extends BrowserTestBase {
    */
   protected function request($method, Url $url, array $request_options) {
     $request_options[RequestOptions::HTTP_ERRORS] = FALSE;
+    $request_options[RequestOptions::ALLOW_REDIRECTS] = FALSE;
     $request_options = $this->decorateWithXdebugCookie($request_options);
     $client = $this->getSession()->getDriver()->getClient()->getClient();
     return $client->request($method, $url->setAbsolute(TRUE)->toString(), $request_options);
@@ -351,12 +351,7 @@ abstract class ResourceTestBase extends BrowserTestBase {
    */
   protected function assertResourceResponse($expected_status_code, $expected_body, ResponseInterface $response) {
     $this->assertSame($expected_status_code, $response->getStatusCode());
-    if ($expected_status_code < 400) {
-      $this->assertSame([static::$mimeType], $response->getHeader('Content-Type'));
-    }
-    else {
-      $this->assertSame([static::$mimeType], $response->getHeader('Content-Type'));
-    }
+    $this->assertSame([static::$mimeType], $response->getHeader('Content-Type'));
     if ($expected_body !== FALSE) {
       $this->assertSame($expected_body, (string) $response->getBody());
     }