#284887 by Dave Reid and dww: Disable autocomplete if user does not have access to the callback.

1 files changed, 60 insertions, 2 deletions

diff --git a/modules/profile/profile.test b/modules/profile/profile.test
index 8665457f7..485b79336 100644
--- a/modules/profile/profile.test
+++ b/modules/profile/profile.test
@@ -248,13 +248,71 @@ class ProfileTestWeights extends ProfileTestCase {
   }
 }
 
+/**
+ * Test profile field autocompletion and access.
+ */
+class ProfileTestAutocomplete extends ProfileTestCase {
+
+  /**
+   * Implementation of getInfo().
+   */
+  function getInfo() {
+    return array(
+      'name' => t('Autocompletion'),
+      'description' => t('Test profile fields with autocompletion.'),
+      'group' => t('Profile')
+    );
+  }
+
+  /**
+   * Tests profile field autocompletion and access.
+   */
+  function testAutocomplete() {
+    $this->drupalLogin($this->admin_user);
+
+    // Create a new profile field with autocompletion enabled.
+    $category = $this->randomName();
+    $field = $this->createProfileField('textfield', $category, array('weight' => 1, 'autocomplete' => 1));
+
+    // Enter profile field value.
+    $field['value'] = $this->randomName();
+    $this->setProfileField($field, $field['value']);
+
+    // Set some html for what we want to see in the page output later.
+    $autocomplete_html = '<input class="autocomplete" type="hidden" id="' . form_clean_id('edit-' . $field['form_name'] . '-autocomplete') . '" value="' . url('profile/autocomplete/' . $field['fid'], array('absolute' => TRUE)) . '" disabled="disabled" />';
+    $field_html = '<input type="text" maxlength="255" name="' . $field['form_name'] . '" id="'. form_clean_id('edit-' . $field['form_name']) . '" size="60" value="' . $field['value'] . '" class="form-text form-autocomplete required" />';
+
+    // Check that autocompletion html is found on the user's profile edit page.
+    $this->drupalGet('user/' . $this->admin_user->uid . '/edit/' . $category);
+    $this->assertRaw($autocomplete_html, t('Autocomplete found.'));
+    $this->assertRaw('misc/autocomplete.js', t('Autocomplete JavaScript found.'));
+    $this->assertRaw('class="form-text form-autocomplete"', t('Autocomplete form element class found.'));
+
+    // Check the autocompletion path using the first letter of our user's profile
+    // field value to make sure access is allowed and a valid result if found.
+    $this->drupalGet('profile/autocomplete/' . $field['fid'] . '/' . $field['value'][0]);
+    $this->assertResponse(200, t('Autocomplete path allowed to user with permission.'));
+    $this->assertRaw($field['value'], t('Autocomplete value found.'));
+
+    // Logout and login with a user without the 'access user profiles' permission.
+    $this->drupalLogout();
+    $this->drupalLogin($this->normal_user);
+
+    // Check that autocompletion html is not found on the user's profile edit page.
+    $this->drupalGet('user/' . $this->normal_user->uid . '/edit/' . $category);
+    $this->assertNoRaw($autocomplete_html, t('Autocomplete not found.'));
+
+    // User should be denied access to the profile autocomplete path.
+    $this->drupalGet('profile/autocomplete/' . $field['fid'] . '/' . $field['value'][0]);
+    $this->assertResponse(403, t('Autocomplete path denied to user without permission.'));
+  }
+}
+
   /**
    * TODO:
    * - Test field visibility
    * - Test profile browsing
-   * - Test autocomplete
    * - Test required fields
    * - Test fields on registration form
    * - Test updating fields
    */
-