function FileFieldWidgetTestCase::testTemporaryFileRemovalExploitAnonymous

Tests exploiting the temporary file removal for anonymous users using fid.

File

modules/file/tests/file.test, line 633

Class

FileFieldWidgetTestCase

Tests file field widget.

Code

public function testTemporaryFileRemovalExploitAnonymous() {
    // Set up an anonymous victim user.
    $victim_uid = 0;
    // Set up an anonymous attacker user.
    $attacker_uid = 0;
    // Set up permissions for anonymous attacker user.
    user_role_change_permissions(DRUPAL_ANONYMOUS_RID, array(
        'access content' => TRUE,
        'create page content' => TRUE,
        'edit any page content' => TRUE,
    ));
    // In order to simulate being the anonymous attacker user, we need to log
    // out here since setUp() has logged in the admin.
    $this->drupalLogout();
    // Perform tests using the newly set up users.
    $this->doTestTemporaryFileRemovalExploit($victim_uid, $attacker_uid);
}