SA-CORE-2016-002 by catch, dawehner, dsnopek, greggles, Plazik, stefan.r, xjm, klausi, mlhess

5 files changed, 78 insertions, 6 deletions

diff --git a/core/modules/statistics/config/schema/statistics.views.schema.yml b/core/modules/statistics/config/schema/statistics.views.schema.yml
new file mode 100644
index 0000000..31a3325
--- /dev/null
+++ b/core/modules/statistics/config/schema/statistics.views.schema.yml
@@ -0,0 +1,9 @@
+# Schema for the views plugins of the Statistics module.
+
+views.field.statistics_numeric:
+  type: views.field.numeric
+  label: 'Numeric values from the statistics module'
+
+views.field.node_counter_timestamp:
+  type: views.field.date
+  label: 'The most recent time the node has been viewed'
diff --git a/core/modules/statistics/src/Plugin/views/field/NodeCounterTimestamp.php b/core/modules/statistics/src/Plugin/views/field/NodeCounterTimestamp.php
new file mode 100644
index 0000000..fb0eb30
--- /dev/null
+++ b/core/modules/statistics/src/Plugin/views/field/NodeCounterTimestamp.php
@@ -0,0 +1,24 @@
+<?php
+
+namespace Drupal\statistics\Plugin\views\field;
+
+use Drupal\views\Plugin\views\field\Date;
+use Drupal\Core\Session\AccountInterface;
+
+/**
+ * Field handler to display the most recent time the node has been viewed.
+ *
+ * @ingroup views_field_handlers
+ *
+ * @ViewsField("node_counter_timestamp")
+ */
+class NodeCounterTimestamp extends Date {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function access(AccountInterface $account) {
+    return $account->hasPermission('view post access counter');
+  }
+
+}
diff --git a/core/modules/statistics/src/Plugin/views/field/StatisticsNumeric.php b/core/modules/statistics/src/Plugin/views/field/StatisticsNumeric.php
new file mode 100644
index 0000000..a425b31
--- /dev/null
+++ b/core/modules/statistics/src/Plugin/views/field/StatisticsNumeric.php
@@ -0,0 +1,24 @@
+<?php
+
+namespace Drupal\statistics\Plugin\views\field;
+
+use Drupal\views\Plugin\views\field\NumericField;
+use Drupal\Core\Session\AccountInterface;
+
+/**
+ * Field handler to display numeric values from the statistics module.
+ *
+ * @ingroup views_field_handlers
+ *
+ * @ViewsField("statistics_numeric")
+ */
+class StatisticsNumeric extends NumericField {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function access(AccountInterface $account) {
+    return $account->hasPermission('view post access counter');
+  }
+
+}
diff --git a/core/modules/statistics/src/Tests/Views/IntegrationTest.php b/core/modules/statistics/src/Tests/Views/IntegrationTest.php
index 4882fd2..07380c8 100644
--- a/core/modules/statistics/src/Tests/Views/IntegrationTest.php
+++ b/core/modules/statistics/src/Tests/Views/IntegrationTest.php
@@ -47,8 +47,11 @@ class IntegrationTest extends ViewTestBase {
 
     ViewTestData::createTestViews(get_class($this), array('statistics_test_views'));
 
-    // Create a new user for viewing nodes.
-    $this->webUser = $this->drupalCreateUser(array('access content'));
+    // Create a new user for viewing nodes and statistics.
+    $this->webUser = $this->drupalCreateUser(array('access content', 'view post access counter'));
+
+    // Create a new user for viewing nodes only.
+    $this->deniedUser = $this->drupalCreateUser(array('access content'));
 
     $this->drupalCreateContentType(array('type' => 'page'));
     $this->node = $this->drupalCreateNode(array('type' => 'page'));
@@ -59,13 +62,14 @@ class IntegrationTest extends ViewTestBase {
       ->set('count_content_views', 1)
       ->save();
 
-    $this->drupalLogin($this->webUser);
   }
 
   /**
    * Tests the integration of the {node_counter} table in views.
    */
   public function testNodeCounterIntegration() {
+    $this->drupalLogin($this->webUser);
+
     $this->drupalGet('node/' . $this->node->id());
     // Manually calling statistics.php, simulating ajax behavior.
     // @see \Drupal\statistics\Tests\StatisticsLoggingTest::testLogging().
@@ -84,6 +88,17 @@ class IntegrationTest extends ViewTestBase {
       $xpath = "//div[contains(@class, views-field-$field)]/span[@class = 'field-content']";
       $this->assertFieldByXpath($xpath, $value, "The $field output matches the expected.");
     }
+
+    $this->drupalLogout();
+    $this->drupalLogin($this->deniedUser);
+    $this->drupalGet('test_statistics_integration');
+    $this->assertResponse(200);
+
+    foreach ($expected as $field => $value) {
+      $xpath = "//div[contains(@class, views-field-$field)]/span[@class = 'field-content']";
+      $this->assertNoFieldByXpath($xpath, $value, "The $field output is not displayed.");
+    }
+
   }
 
 }
diff --git a/core/modules/statistics/statistics.views.inc b/core/modules/statistics/statistics.views.inc
index c3fdaa1..e851251 100644
--- a/core/modules/statistics/statistics.views.inc
+++ b/core/modules/statistics/statistics.views.inc
@@ -22,7 +22,7 @@ function statistics_views_data() {
     'title' => t('Total views'),
     'help' => t('The total number of times the node has been viewed.'),
     'field' => array(
-      'id' => 'numeric',
+      'id' => 'statistics_numeric',
       'click sortable' => TRUE,
      ),
     'filter' => array(
@@ -40,7 +40,7 @@ function statistics_views_data() {
     'title' => t('Views today'),
     'help' => t('The total number of times the node has been viewed today.'),
     'field' => array(
-      'id' => 'numeric',
+      'id' => 'statistics_numeric',
       'click sortable' => TRUE,
      ),
     'filter' => array(
@@ -58,7 +58,7 @@ function statistics_views_data() {
     'title' => t('Most recent view'),
     'help' => t('The most recent time the node has been viewed.'),
     'field' => array(
-      'id' => 'date',
+      'id' => 'node_counter_timestamp',
       'click sortable' => TRUE,
     ),
     'filter' => array(