0

I'm trying to test the permissions of a particular role, and this code:

$this->drupalLogin($this->editor_user);
$this->drupalGet($node->path['source']);

returns a 200 (OK) status, when I'm expecting a 403 (forbidden).

Does DrupalWebTestCase::drupalGet() ignore the permissions of the currently logged-in user, and if so, how can I test page view permissions?

0

Permissions to access the page are considered. ContactPersonalTestCase::testPersonalContactAccess() uses the following code to check users has permission to access the right contact pages.

  // Test allowed access to user with contact form enabled.
  $this->drupalLogin($this->web_user);
  $this->drupalGet('user/' . $this->contact_user->uid . '/contact');
  $this->assertResponse(200);

  // Test denied access to the user's own contact form.
  $this->drupalGet('user/' . $this->web_user->uid . '/contact');
  $this->assertResponse(403);

  // Test always denied access to the anonymous user contact form.
  $this->drupalGet('user/0/contact');
  $this->assertResponse(403);

  // Test that anonymous users can access the contact form.
  $this->drupalLogout();
  user_role_grant_permissions(DRUPAL_ANONYMOUS_RID, array('access user contact forms'));
  $this->drupalGet('user/' . $this->contact_user->uid . '/contact');
  $this->assertResponse(200);

$this->web_user, and $this->contact_user are initialized using the following code.

$this->web_user = $this->drupalCreateUser(array('access user contact forms'));
$this->contact_user = $this->drupalCreateUser();

If the permissions assigned to the test user would not be considered, the first test would fail, as only users with the "access user contact forms" permission can see the contact page of another user, and by default users don't have that permission.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.