1 files changed, 43 insertions, 0 deletions
diff --git a/modules/system/system.test b/modules/system/system.test
index aefbfbc46..dcc86e539 100644
--- a/modules/system/system.test
+++ b/modules/system/system.test
@@ -2825,3 +2825,46 @@ class SystemValidTokenTest extends DrupalUnitTestCase {
     return TRUE;
   }
 }
+
+/**
+ * Tests confirm form destinations.
+ */
+class ConfirmFormTest extends DrupalWebTestCase {
+  protected $admin_user;
+
+  public static function getInfo() {
+    return array(
+      'name' => 'Confirm form',
+      'description' => 'Tests that the confirm form does not use external destinations.',
+      'group' => 'System',
+    );
+  }
+
+  function setUp() {
+    parent::setUp();
+
+    $this->admin_user = $this->drupalCreateUser(array('administer users'));
+    $this->drupalLogin($this->admin_user);
+  }
+
+  /**
+   * Tests that the confirm form does not use external destinations.
+   */
+  function testConfirmForm() {
+    $this->drupalGet('user/1/cancel');
+    $this->assertCancelLinkUrl(url('user/1'));
+    $this->drupalGet('user/1/cancel', array('query' => array('destination' => 'node')));
+    $this->assertCancelLinkUrl(url('node'));
+    $this->drupalGet('user/1/cancel', array('query' => array('destination' => 'http://example.com')));
+    $this->assertCancelLinkUrl(url('user/1'));
+  }
+
+  /**
+   * Asserts that a cancel link is present pointing to the provided URL.
+   */
+  function assertCancelLinkUrl($url, $message = '', $group = 'Other') {
+    $links = $this->xpath('//a[normalize-space(text())=:label and @href=:url]', array(':label' => t('Cancel'), ':url' => $url));
+    $message = ($message ? $message : format_string('Cancel link with url %url found.', array('%url' => $url)));
+    return $this->assertTrue(isset($links[0]), $message, $group);
+  }
+}