- Patch ##239676 by v1nce, pwolanin, mfb: fixed SA-CORE-2009-001: missing validation for hook_user().

1 files changed, 35 insertions, 0 deletions

diff --git a/modules/user/user.test b/modules/user/user.test
index 343e0cbc5..9be01f80e 100644
--- a/modules/user/user.test
+++ b/modules/user/user.test
@@ -1186,3 +1186,38 @@ class UserSaveTestCase extends DrupalWebTestCase {
     $this->assertTrue($user_by_name, t('Loading user by name.'));
   }
 }
+
+/**
+ * Test case to test user_save() behaviour.
+ */
+class UserEditTestCase extends DrupalWebTestCase {
+
+  public static function getInfo() {
+    return array(
+      'name' => 'User edit',
+      'description' => 'Test user edit page.',
+      'group' => 'User',
+    );
+  }
+
+  /**
+   * Test user edit page.
+   */
+  function testUserEdit() {
+    // Test user edit functionality with user pictures disabled.
+    variable_set('user_pictures', 0);
+    $user1 = $this->drupalCreateUser(array('change own username'));
+    $user2 = $this->drupalCreateUser(array());
+    $this->drupalLogin($user1);
+
+    // Test that error message appears when attempting to use a non-unique user name.
+    $edit['name'] = $user2->name;
+    $this->drupalPost("user/$user1->uid/edit", $edit, t('Save'));
+    $this->assertRaw(t('The name %name is already taken.', array('%name' => $edit['name'])));
+
+    // Repeat the test with user pictures enabled, which modifies the form.
+    variable_set('user_pictures', 1);
+    $this->drupalPost("user/$user1->uid/edit", $edit, t('Save'));
+    $this->assertRaw(t('The name %name is already taken.', array('%name' => $edit['name'])));
+  }
+}