diff --git a/pages/exec.php b/pages/exec.php
index c07eb1c1d..b398a45d0 100644
--- a/pages/exec.php
+++ b/pages/exec.php
@@ -106,7 +106,9 @@ $aModuleDelegatedExecutionPolicy = GetModuleDelegatedExecutionPolicy($sModule);
if (is_null($aModuleDelegatedExecutionPolicy) || !in_array($sPage, $aModuleDelegatedExecutionPolicy)) {
$bForceLoginWhenNoExecutionPolicy = MetaModel::GetConfig()->Get('security.force_login_when_no_execution_policy');
// TODO in N°9343 : remove the conf and this 'if' condition to perform login by default when no execution policy is defined
- LoginWebPage::DoLoginEx();
+ if ($bForceLoginWhenNoExecutionPolicy) {
+ LoginWebPage::DoLoginEx();
+ }
}
if (is_array($aModuleDelegatedExecutionPolicy) && !in_array($sPage, $aModuleDelegatedExecutionPolicy)) {
// if module defined a delegated execution policy but not for the current page, we consider that the page is not allowed to be executed without login
diff --git a/tests/php-unit-tests/integration-tests/login-tests/LoginWebPageTest.php b/tests/php-unit-tests/integration-tests/login-tests/LoginWebPageTest.php
index ae793f556..39b425a77 100644
--- a/tests/php-unit-tests/integration-tests/login-tests/LoginWebPageTest.php
+++ b/tests/php-unit-tests/integration-tests/login-tests/LoginWebPageTest.php
@@ -95,10 +95,64 @@ class LoginWebPageTest extends ItopDataTestCase
public function testNotInExecutionPolicyFileWithoutForceLoginConf()
{
$sPageContent = $this->CallItopUri(
- "pages/exec.php?exec_module=extension-with-execution-policy&exec_page=src/Controller/AnotherFile.php",
+ "pages/exec.php?exec_module=extension-without-execution-policy&exec_page=src/Controller/AnotherFile.php",
+ [],
+ [],
+ true
);
$this->assertStringNotContainsString('
iTop login', $sPageContent); // by default (until N°9343) if no execution policy is defined, login is not forced
}
+ public function testNotInExecutionPolicyFileWithoutForceLoginConfButWithExecutionPolicy()
+ {
+ $sPageContent = $this->CallItopUri(
+ "pages/exec.php?exec_module=extension-with-execution-policy&exec_page=src/Controller/AnotherFile.php",
+ [],
+ [],
+ true
+ );
+
+ $this->assertStringContainsString('iTop login', $sPageContent); // Since an execution policy is defined and AnotherFile.php isn't in it, login should be proposed
+ }
+
+ /**
+ * @dataProvider InExecutionPolicyFileWithAdminRequiredProvider
+ *
+ * @throws \Exception
+ */
+ public function testInExecutionPolicyFileWithAdminRequired($iProfileId, $ForbiddenPageShouldBeDisplayed)
+ {
+ // generate random login
+ $sUserLogin = 'user-'.date('YmdHis');
+ $this->CreateUser($sUserLogin, $iProfileId, self::PASSWORD);
+ $this->GivenConfigFileAllowedLoginTypes(explode('|', 'form'));
+
+ $sPageContent = $this->CallItopUri(
+ "pages/exec.php?exec_module=extension-with-execution-policy&exec_page=src/Controller/CheckAnythingButAdminRequired.php",
+ [
+ 'auth_user' => $sUserLogin,
+ 'auth_pwd' => self::PASSWORD,
+ ],
+ [],
+ true
+ );
+ $ForbiddenPageShouldBeDisplayed ?
+ $this->assertStringContainsString('Yo !', $sPageContent) :
+ $this->assertStringNotContainsString('Access restricted to people having administrator privileges', $sPageContent); // in execution policy file (in the module), login should not be proposed, file handle its own policy
+ }
+
+ public function InExecutionPolicyFileWithAdminRequiredProvider()
+ {
+ return [
+ 'Administrator profile' => [
+ self::$aURP_Profiles['Administrator'],
+ true,
+ ],
+ 'ReadOnly profile' => [
+ self::$aURP_Profiles['Service Desk Agent'],
+ false,
+ ],
+ ];
+ }
}
diff --git a/tests/php-unit-tests/integration-tests/login-tests/extension-with-execution-policy/module.extension-with-execution-policy.php b/tests/php-unit-tests/integration-tests/login-tests/extension-with-execution-policy/module.extension-with-execution-policy.php
index 22b819713..bfc1f442c 100644
--- a/tests/php-unit-tests/integration-tests/login-tests/extension-with-execution-policy/module.extension-with-execution-policy.php
+++ b/tests/php-unit-tests/integration-tests/login-tests/extension-with-execution-policy/module.extension-with-execution-policy.php
@@ -19,6 +19,7 @@ SetupWebPage::AddModule(
// Security
'execution_policy' => [
'src/Controller/CheckAnything.php',
+ 'src/Controller/CheckAnythingButAdminRequired.php',
],
// Components
diff --git a/tests/php-unit-tests/integration-tests/login-tests/extension-with-execution-policy/src/Controller/CheckAnythingButAdminRequired.php b/tests/php-unit-tests/integration-tests/login-tests/extension-with-execution-policy/src/Controller/CheckAnythingButAdminRequired.php
new file mode 100644
index 000000000..9ad77ae09
--- /dev/null
+++ b/tests/php-unit-tests/integration-tests/login-tests/extension-with-execution-policy/src/Controller/CheckAnythingButAdminRequired.php
@@ -0,0 +1,5 @@
+