Refs CakeDC#376 redirect when anonym try to freely access change password

Author: Pedro F Steimbruch

src/Controller/Traits/PasswordManagementTrait.php

@@ -43,6 +43,11 @@ public function changePassword()
         } else {
             $user->id = $this->request->session()->read(Configure::read('Users.Key.Session.resetPasswordUserId'));
             $validatePassword = false;
+            if (!$user->id) {
+                $this->Flash->error(__d('CakeDC/Users', 'User was not found'));
+                $this->redirect($this->Auth->config('loginAction'));
+                return;
+            }
             //@todo add to the documentation: list of routes used
             $redirect = $this->Auth->config('loginAction');
         }

tests/TestCase/Controller/Traits/BaseTraitTest.php

@@ -87,15 +87,40 @@ public function tearDown()
         parent::tearDown();
     }
 
+    /**
+     * Mock session and mock session attributes
+     *
+     * @return void
+     */
+    protected function _mockSession($attributes)
+    {
+        $session = new \Cake\Network\Session();
+
+        foreach ($attributes as $field => $value) {
+            $session->write($field, $value);
+        }
+
+        $this->Trait->request
+            ->expects($this->any())
+            ->method('session')
+            ->willReturn($session);
+    }
+
     /**
      * mock request for GET
      *
      * @return void
      */
-    protected function _mockRequestGet()
+    protected function _mockRequestGet($withSession = false)
     {
+        $methods = ['is', 'referer', 'data'];
+
+        if ($withSession) {
+            $methods[] = 'session';
+        }
+
         $this->Trait->request = $this->getMockBuilder('Cake\Network\Request')
-                ->setMethods(['is', 'referer', 'data'])
+                ->setMethods($methods)
                 ->getMock();
         $this->Trait->request->expects($this->any())
                 ->method('is')

tests/TestCase/Controller/Traits/PasswordManagementTraitTest.php

@@ -215,17 +215,37 @@ public function testChangePasswordGetLoggedIn()
      *
      * @return void
      */
-    public function testChangePasswordGetNotLoggedIn()
+    public function testChangePasswordGetNotLoggedInInsideResetPasswordFlow()
     {
-        $this->_mockRequestGet();
+        $this->_mockRequestGet(true);
         $this->_mockAuth();
+        $this->_mockFlash();
+        $this->_mockSession([
+            Configure::read('Users.Key.Session.resetPasswordUserId') => '00000000-0000-0000-0000-000000000001'
+        ]);
         $this->Trait->expects($this->any())
-                ->method('set')
-                ->will($this->returnCallback(function ($param1, $param2 = null) {
-                    if ($param1 === 'validatePassword') {
-                        TestCase::assertEquals($param2, false);
-                    }
-                }));
+            ->method('set')
+            ->will($this->returnCallback(function ($param1, $param2 = null) {
+                if ($param1 === 'validatePassword') {
+                    TestCase::assertEquals($param2, false);
+                }
+            }));
+        $this->Trait->changePassword();
+    }
+
+    /**
+     * test
+     *
+     * @return void
+     */
+    public function testChangePasswordGetNotLoggedInOutsideResetPasswordFlow()
+    {
+        $this->_mockRequestGet();
+        $this->_mockAuth();
+        $this->_mockFlash();
+        $this->Trait->Flash->expects($this->once())
+            ->method('error')
+            ->with('User was not found');
         $this->Trait->changePassword();
     }