BookStack Code Mirror - bookstack/blob - tests/Entity/ExportTest.php

   1 <?php
   2
   3 namespace Tests\Entity;
   4
   5 use BookStack\Auth\Role;
   6 use BookStack\Entities\Models\Book;
   7 use BookStack\Entities\Models\Chapter;
   8 use BookStack\Entities\Models\Page;
   9 use BookStack\Entities\Tools\PdfGenerator;
  10 use Illuminate\Support\Facades\Storage;
  11 use Illuminate\Support\Str;
  12 use Tests\TestCase;
  13
  14 class ExportTest extends TestCase
  15 {
  16     public function test_page_text_export()
  17     {
  18         $page = Page::query()->first();
  19         $this->asEditor();
  20
  21         $resp = $this->get($page->getUrl('/export/plaintext'));
  22         $resp->assertStatus(200);
  23         $resp->assertSee($page->name);
  24         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.txt"');
  25     }
  26
  27     public function test_page_pdf_export()
  28     {
  29         $page = Page::query()->first();
  30         $this->asEditor();
  31
  32         $resp = $this->get($page->getUrl('/export/pdf'));
  33         $resp->assertStatus(200);
  34         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.pdf"');
  35     }
  36
  37     public function test_page_html_export()
  38     {
  39         $page = Page::query()->first();
  40         $this->asEditor();
  41
  42         $resp = $this->get($page->getUrl('/export/html'));
  43         $resp->assertStatus(200);
  44         $resp->assertSee($page->name);
  45         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.html"');
  46     }
  47
  48     public function test_book_text_export()
  49     {
  50         $page = Page::query()->first();
  51         $book = $page->book;
  52         $this->asEditor();
  53
  54         $resp = $this->get($book->getUrl('/export/plaintext'));
  55         $resp->assertStatus(200);
  56         $resp->assertSee($book->name);
  57         $resp->assertSee($page->name);
  58         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $book->slug . '.txt"');
  59     }
  60
  61     public function test_book_pdf_export()
  62     {
  63         $page = Page::query()->first();
  64         $book = $page->book;
  65         $this->asEditor();
  66
  67         $resp = $this->get($book->getUrl('/export/pdf'));
  68         $resp->assertStatus(200);
  69         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $book->slug . '.pdf"');
  70     }
  71
  72     public function test_book_html_export()
  73     {
  74         $page = Page::query()->first();
  75         $book = $page->book;
  76         $this->asEditor();
  77
  78         $resp = $this->get($book->getUrl('/export/html'));
  79         $resp->assertStatus(200);
  80         $resp->assertSee($book->name);
  81         $resp->assertSee($page->name);
  82         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $book->slug . '.html"');
  83     }
  84
  85     public function test_book_html_export_shows_chapter_descriptions()
  86     {
  87         $chapterDesc = 'My custom test chapter description ' . Str::random(12);
  88         $chapter = Chapter::query()->first();
  89         $chapter->description = $chapterDesc;
  90         $chapter->save();
  91
  92         $book = $chapter->book;
  93         $this->asEditor();
  94
  95         $resp = $this->get($book->getUrl('/export/html'));
  96         $resp->assertSee($chapterDesc);
  97     }
  98
  99     public function test_chapter_text_export()
 100     {
 101         $chapter = Chapter::query()->first();
 102         $page = $chapter->pages[0];
 103         $this->asEditor();
 104
 105         $resp = $this->get($chapter->getUrl('/export/plaintext'));
 106         $resp->assertStatus(200);
 107         $resp->assertSee($chapter->name);
 108         $resp->assertSee($page->name);
 109         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $chapter->slug . '.txt"');
 110     }
 111
 112     public function test_chapter_pdf_export()
 113     {
 114         $chapter = Chapter::query()->first();
 115         $this->asEditor();
 116
 117         $resp = $this->get($chapter->getUrl('/export/pdf'));
 118         $resp->assertStatus(200);
 119         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $chapter->slug . '.pdf"');
 120     }
 121
 122     public function test_chapter_html_export()
 123     {
 124         $chapter = Chapter::query()->first();
 125         $page = $chapter->pages[0];
 126         $this->asEditor();
 127
 128         $resp = $this->get($chapter->getUrl('/export/html'));
 129         $resp->assertStatus(200);
 130         $resp->assertSee($chapter->name);
 131         $resp->assertSee($page->name);
 132         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $chapter->slug . '.html"');
 133     }
 134
 135     public function test_page_html_export_contains_custom_head_if_set()
 136     {
 137         $page = Page::query()->first();
 138
 139         $customHeadContent = '<style>p{color: red;}</style>';
 140         $this->setSettings(['app-custom-head' => $customHeadContent]);
 141
 142         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 143         $resp->assertSee($customHeadContent, false);
 144     }
 145
 146     public function test_page_html_export_does_not_break_with_only_comments_in_custom_head()
 147     {
 148         $page = Page::query()->first();
 149
 150         $customHeadContent = '<!-- A comment -->';
 151         $this->setSettings(['app-custom-head' => $customHeadContent]);
 152
 153         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 154         $resp->assertStatus(200);
 155         $resp->assertSee($customHeadContent, false);
 156     }
 157
 158     public function test_page_html_export_use_absolute_dates()
 159     {
 160         $page = Page::query()->first();
 161
 162         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 163         $resp->assertSee($page->created_at->formatLocalized('%e %B %Y %H:%M:%S'));
 164         $resp->assertDontSee($page->created_at->diffForHumans());
 165         $resp->assertSee($page->updated_at->formatLocalized('%e %B %Y %H:%M:%S'));
 166         $resp->assertDontSee($page->updated_at->diffForHumans());
 167     }
 168
 169     public function test_page_export_does_not_include_user_or_revision_links()
 170     {
 171         $page = Page::query()->first();
 172
 173         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 174         $resp->assertDontSee($page->getUrl('/revisions'));
 175         $resp->assertDontSee($page->createdBy->getProfileUrl());
 176         $resp->assertSee($page->createdBy->name);
 177     }
 178
 179     public function test_page_export_sets_right_data_type_for_svg_embeds()
 180     {
 181         $page = Page::query()->first();
 182         Storage::disk('local')->makeDirectory('uploads/images/gallery');
 183         Storage::disk('local')->put('uploads/images/gallery/svg_test.svg', '<svg></svg>');
 184         $page->html = '<img src="http://localhost/uploads/images/gallery/svg_test.svg">';
 185         $page->save();
 186
 187         $this->asEditor();
 188         $resp = $this->get($page->getUrl('/export/html'));
 189         Storage::disk('local')->delete('uploads/images/gallery/svg_test.svg');
 190
 191         $resp->assertStatus(200);
 192         $resp->assertSee('<img src="data:image/svg+xml;base64', false);
 193     }
 194
 195     public function test_page_image_containment_works_on_multiple_images_within_a_single_line()
 196     {
 197         $page = Page::query()->first();
 198         Storage::disk('local')->makeDirectory('uploads/images/gallery');
 199         Storage::disk('local')->put('uploads/images/gallery/svg_test.svg', '<svg></svg>');
 200         Storage::disk('local')->put('uploads/images/gallery/svg_test2.svg', '<svg></svg>');
 201         $page->html = '<img src="http://localhost/uploads/images/gallery/svg_test.svg" class="a"><img src="http://localhost/uploads/images/gallery/svg_test2.svg" class="b">';
 202         $page->save();
 203
 204         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 205         Storage::disk('local')->delete('uploads/images/gallery/svg_test.svg');
 206         Storage::disk('local')->delete('uploads/images/gallery/svg_test2.svg');
 207
 208         $resp->assertDontSee('http://localhost/uploads/images/gallery/svg_test');
 209     }
 210
 211     public function test_page_export_contained_html_image_fetches_only_run_when_url_points_to_image_upload_folder()
 212     {
 213         $page = Page::query()->first();
 214         $page->html = '<img src="http://localhost/uploads/images/gallery/svg_test.svg"/>'
 215             . '<img src="http://localhost/uploads/svg_test.svg"/>'
 216             . '<img src="/uploads/svg_test.svg"/>';
 217         $storageDisk = Storage::disk('local');
 218         $storageDisk->makeDirectory('uploads/images/gallery');
 219         $storageDisk->put('uploads/images/gallery/svg_test.svg', '<svg>good</svg>');
 220         $storageDisk->put('uploads/svg_test.svg', '<svg>bad</svg>');
 221         $page->save();
 222
 223         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 224
 225         $storageDisk->delete('uploads/images/gallery/svg_test.svg');
 226         $storageDisk->delete('uploads/svg_test.svg');
 227
 228         $resp->assertDontSee('http://localhost/uploads/images/gallery/svg_test.svg', false);
 229         $resp->assertSee('http://localhost/uploads/svg_test.svg');
 230         $resp->assertSee('src="/uploads/svg_test.svg"', false);
 231     }
 232
 233     public function test_page_export_contained_html_does_not_allow_upward_traversal_with_local()
 234     {
 235         $contents = file_get_contents(public_path('.htaccess'));
 236         config()->set('filesystems.images', 'local');
 237
 238         $page = Page::query()->first();
 239         $page->html = '<img src="http://localhost/uploads/images/../../.htaccess"/>';
 240         $page->save();
 241
 242         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 243         $resp->assertDontSee(base64_encode($contents));
 244     }
 245
 246     public function test_page_export_contained_html_does_not_allow_upward_traversal_with_local_secure()
 247     {
 248         $testFilePath = storage_path('logs/test.txt');
 249         config()->set('filesystems.images', 'local_secure');
 250         file_put_contents($testFilePath, 'I am a cat');
 251
 252         $page = Page::query()->first();
 253         $page->html = '<img src="http://localhost/uploads/images/../../logs/test.txt"/>';
 254         $page->save();
 255
 256         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 257         $resp->assertDontSee(base64_encode('I am a cat'));
 258         unlink($testFilePath);
 259     }
 260
 261     public function test_page_export_contained_html_embed_elements_are_converted_to_images_with_srcs_inlined()
 262     {
 263         $page = Page::query()->first();
 264         $page->html = '<embed src="http://localhost/uploads/images/gallery/svg_test.svg"/>';
 265         $page->save();
 266
 267         $storageDisk = Storage::disk('local');
 268         $storageDisk->makeDirectory('uploads/images/gallery');
 269         $storageDisk->put('uploads/images/gallery/svg_test.svg', '<svg>good</svg>');
 270
 271         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 272
 273         $storageDisk->delete('uploads/images/gallery/svg_test.svg');
 274
 275         $resp->assertDontSee('http://localhost/uploads/images/gallery/svg_test.svg', false);
 276         $resp->assertSee('<img src="data:image/svg+xml;base64,PHN2Zz5nb29kPC9zdmc+">', false);
 277     }
 278
 279     public function test_exports_removes_scripts_from_custom_head()
 280     {
 281         $entities = [
 282             Page::query()->first(), Chapter::query()->first(), Book::query()->first(),
 283         ];
 284         setting()->put('app-custom-head', '<script>window.donkey = "cat";</script><style>.my-test-class { color: red; }</style>');
 285
 286         foreach ($entities as $entity) {
 287             $resp = $this->asEditor()->get($entity->getUrl('/export/html'));
 288             $resp->assertDontSee('window.donkey');
 289             $resp->assertDontSee('<script', false);
 290             $resp->assertSee('.my-test-class { color: red; }');
 291         }
 292     }
 293
 294     public function test_page_export_with_deleted_creator_and_updater()
 295     {
 296         $user = $this->getViewer(['name' => 'ExportWizardTheFifth']);
 297         $page = Page::query()->first();
 298         $page->created_by = $user->id;
 299         $page->updated_by = $user->id;
 300         $page->save();
 301
 302         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 303         $resp->assertSee('ExportWizardTheFifth');
 304
 305         $user->delete();
 306         $resp = $this->get($page->getUrl('/export/html'));
 307         $resp->assertStatus(200);
 308         $resp->assertDontSee('ExportWizardTheFifth');
 309     }
 310
 311     public function test_page_pdf_export_converts_iframes_to_links()
 312     {
 313         $page = Page::query()->first()->forceFill([
 314             'html'     => '<iframe width="560" height="315" src="//www.youtube.com/embed/ShqUjt33uOs"></iframe>',
 315         ]);
 316         $page->save();
 317
 318         $pdfHtml = '';
 319         $mockPdfGenerator = $this->mock(PdfGenerator::class);
 320         $mockPdfGenerator->shouldReceive('fromHtml')
 321             ->with(\Mockery::capture($pdfHtml))
 322             ->andReturn('');
 323         $mockPdfGenerator->shouldReceive('getActiveEngine')->andReturn(PdfGenerator::ENGINE_DOMPDF);
 324
 325         $this->asEditor()->get($page->getUrl('/export/pdf'));
 326         $this->assertStringNotContainsString('iframe>', $pdfHtml);
 327         $this->assertStringContainsString('<p><a href="https://www.youtube.com/embed/ShqUjt33uOs">https://www.youtube.com/embed/ShqUjt33uOs</a></p>', $pdfHtml);
 328     }
 329
 330     public function test_page_pdf_export_opens_details_blocks()
 331     {
 332         $page = Page::query()->first()->forceFill([
 333             'html'     => '<details><summary>Hello</summary><p>Content!</p></details>',
 334         ]);
 335         $page->save();
 336
 337         $pdfHtml = '';
 338         $mockPdfGenerator = $this->mock(PdfGenerator::class);
 339         $mockPdfGenerator->shouldReceive('fromHtml')
 340             ->with(\Mockery::capture($pdfHtml))
 341             ->andReturn('');
 342         $mockPdfGenerator->shouldReceive('getActiveEngine')->andReturn(PdfGenerator::ENGINE_DOMPDF);
 343
 344         $this->asEditor()->get($page->getUrl('/export/pdf'));
 345         $this->assertStringContainsString('<details open="open"', $pdfHtml);
 346     }
 347
 348     public function test_page_markdown_export()
 349     {
 350         $page = Page::query()->first();
 351
 352         $resp = $this->asEditor()->get($page->getUrl('/export/markdown'));
 353         $resp->assertStatus(200);
 354         $resp->assertSee($page->name);
 355         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.md"');
 356     }
 357
 358     public function test_page_markdown_export_uses_existing_markdown_if_apparent()
 359     {
 360         $page = Page::query()->first()->forceFill([
 361             'markdown' => '# A header',
 362             'html'     => '<h1>Dogcat</h1>',
 363         ]);
 364         $page->save();
 365
 366         $resp = $this->asEditor()->get($page->getUrl('/export/markdown'));
 367         $resp->assertSee('A header');
 368         $resp->assertDontSee('Dogcat');
 369     }
 370
 371     public function test_page_markdown_export_converts_html_where_no_markdown()
 372     {
 373         $page = Page::query()->first()->forceFill([
 374             'markdown' => '',
 375             'html'     => '<h1>Dogcat</h1><p>Some <strong>bold</strong> text</p>',
 376         ]);
 377         $page->save();
 378
 379         $resp = $this->asEditor()->get($page->getUrl('/export/markdown'));
 380         $resp->assertSee("# Dogcat\n\nSome **bold** text");
 381     }
 382
 383     public function test_chapter_markdown_export()
 384     {
 385         $chapter = Chapter::query()->first();
 386         $page = $chapter->pages()->first();
 387         $resp = $this->asEditor()->get($chapter->getUrl('/export/markdown'));
 388
 389         $resp->assertSee('# ' . $chapter->name);
 390         $resp->assertSee('# ' . $page->name);
 391     }
 392
 393     public function test_book_markdown_export()
 394     {
 395         $book = Book::query()->whereHas('pages')->whereHas('chapters')->first();
 396         $chapter = $book->chapters()->first();
 397         $page = $chapter->pages()->first();
 398         $resp = $this->asEditor()->get($book->getUrl('/export/markdown'));
 399
 400         $resp->assertSee('# ' . $book->name);
 401         $resp->assertSee('# ' . $chapter->name);
 402         $resp->assertSee('# ' . $page->name);
 403     }
 404
 405     public function test_book_markdown_export_concats_immediate_pages_with_newlines()
 406     {
 407         /** @var Book $book */
 408         $book = Book::query()->whereHas('pages')->first();
 409
 410         $this->asEditor()->get($book->getUrl('/create-page'));
 411         $this->get($book->getUrl('/create-page'));
 412
 413         [$pageA, $pageB] = $book->pages()->where('chapter_id', '=', 0)->get();
 414         $pageA->html = '<p>hello tester</p>';
 415         $pageA->save();
 416         $pageB->name = 'The second page in this test';
 417         $pageB->save();
 418
 419         $resp = $this->get($book->getUrl('/export/markdown'));
 420         $resp->assertDontSee('hello tester# The second page in this test');
 421         $resp->assertSee("hello tester\n\n# The second page in this test");
 422     }
 423
 424     public function test_export_option_only_visible_and_accessible_with_permission()
 425     {
 426         $book = Book::query()->whereHas('pages')->whereHas('chapters')->first();
 427         $chapter = $book->chapters()->first();
 428         $page = $chapter->pages()->first();
 429         $entities = [$book, $chapter, $page];
 430         $user = $this->getViewer();
 431         $this->actingAs($user);
 432
 433         foreach ($entities as $entity) {
 434             $resp = $this->get($entity->getUrl());
 435             $resp->assertSee('/export/pdf');
 436         }
 437
 438         /** @var Role $role */
 439         $this->removePermissionFromUser($user, 'content-export');
 440
 441         foreach ($entities as $entity) {
 442             $resp = $this->get($entity->getUrl());
 443             $resp->assertDontSee('/export/pdf');
 444             $resp = $this->get($entity->getUrl('/export/pdf'));
 445             $this->assertPermissionError($resp);
 446         }
 447     }
 448
 449     public function test_wkhtmltopdf_only_used_when_allow_untrusted_is_true()
 450     {
 451         /** @var Page $page */
 452         $page = Page::query()->first();
 453
 454         config()->set('snappy.pdf.binary', '/abc123');
 455         config()->set('app.allow_untrusted_server_fetching', false);
 456
 457         $resp = $this->asEditor()->get($page->getUrl('/export/pdf'));
 458         $resp->assertStatus(200); // Sucessful response with invalid snappy binary indicates dompdf usage.
 459
 460         config()->set('app.allow_untrusted_server_fetching', true);
 461         $resp = $this->get($page->getUrl('/export/pdf'));
 462         $resp->assertStatus(500); // Bad response indicates wkhtml usage
 463     }
 464
 465     public function test_html_exports_contain_csp_meta_tag()
 466     {
 467         $entities = [
 468             Page::query()->first(),
 469             Book::query()->first(),
 470             Chapter::query()->first(),
 471         ];
 472
 473         foreach ($entities as $entity) {
 474             $resp = $this->asEditor()->get($entity->getUrl('/export/html'));
 475             $resp->assertElementExists('head meta[http-equiv="Content-Security-Policy"][content*="script-src "]');
 476         }
 477     }
 478 }