+ $resp->assertSee('src="/uploads/svg_test.svg"', false);
+ }
+
+ public function test_page_export_contained_html_does_not_allow_upward_traversal_with_local()
+ {
+ $contents = file_get_contents(public_path('.htaccess'));
+ config()->set('filesystems.images', 'local');
+
+ $page = Page::query()->first();
+ $page->html = '<img src="http://localhost/uploads/images/../../.htaccess"/>';
+ $page->save();
+
+ $resp = $this->asEditor()->get($page->getUrl('/export/html'));
+ $resp->assertDontSee(base64_encode($contents));
+ }
+
+ public function test_page_export_contained_html_does_not_allow_upward_traversal_with_local_secure()
+ {
+ $testFilePath = storage_path('logs/test.txt');
+ config()->set('filesystems.images', 'local_secure');
+ file_put_contents($testFilePath, 'I am a cat');
+
+ $page = Page::query()->first();
+ $page->html = '<img src="http://localhost/uploads/images/../../logs/test.txt"/>';
+ $page->save();
+
+ $resp = $this->asEditor()->get($page->getUrl('/export/html'));
+ $resp->assertDontSee(base64_encode('I am a cat'));
+ unlink($testFilePath);
+ }
+
+ public function test_exports_removes_scripts_from_custom_head()
+ {
+ $entities = [
+ Page::query()->first(), Chapter::query()->first(), Book::query()->first(),
+ ];
+ setting()->put('app-custom-head', '<script>window.donkey = "cat";</script><style>.my-test-class { color: red; }</style>');
+
+ foreach ($entities as $entity) {
+ $resp = $this->asEditor()->get($entity->getUrl('/export/html'));
+ $resp->assertDontSee('window.donkey');
+ $resp->assertDontSee('script');
+ $resp->assertSee('.my-test-class { color: red; }');
+ }
+ }
+
+ public function test_page_export_with_deleted_creator_and_updater()
+ {
+ $user = $this->getViewer(['name' => 'ExportWizardTheFifth']);
+ $page = Page::query()->first();
+ $page->created_by = $user->id;
+ $page->updated_by = $user->id;
+ $page->save();
+
+ $resp = $this->asEditor()->get($page->getUrl('/export/html'));
+ $resp->assertSee('ExportWizardTheFifth');
+
+ $user->delete();
+ $resp = $this->get($page->getUrl('/export/html'));
+ $resp->assertStatus(200);
+ $resp->assertDontSee('ExportWizardTheFifth');
+ }
+
+ public function test_page_pdf_export_converts_iframes_to_links()
+ {
+ $page = Page::query()->first()->forceFill([
+ 'html' => '<iframe width="560" height="315" src="//www.youtube.com/embed/ShqUjt33uOs"></iframe>',
+ ]);
+ $page->save();
+
+ $pdfHtml = '';
+ $mockPdfGenerator = $this->mock(PdfGenerator::class);
+ $mockPdfGenerator->shouldReceive('fromHtml')
+ ->with(\Mockery::capture($pdfHtml))
+ ->andReturn('');
+ $mockPdfGenerator->shouldReceive('getActiveEngine')->andReturn(PdfGenerator::ENGINE_DOMPDF);
+
+ $this->asEditor()->get($page->getUrl('/export/pdf'));
+ $this->assertStringNotContainsString('iframe>', $pdfHtml);
+ $this->assertStringContainsString('<p><a href="https://www.youtube.com/embed/ShqUjt33uOs">https://www.youtube.com/embed/ShqUjt33uOs</a></p>', $pdfHtml);
+ }
+
+ public function test_page_markdown_export()
+ {
+ $page = Page::query()->first();
+
+ $resp = $this->asEditor()->get($page->getUrl('/export/markdown'));
+ $resp->assertStatus(200);
+ $resp->assertSee($page->name);
+ $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.md"');
+ }
+
+ public function test_page_markdown_export_uses_existing_markdown_if_apparent()
+ {
+ $page = Page::query()->first()->forceFill([
+ 'markdown' => '# A header',
+ 'html' => '<h1>Dogcat</h1>',
+ ]);
+ $page->save();
+
+ $resp = $this->asEditor()->get($page->getUrl('/export/markdown'));
+ $resp->assertSee('A header');
+ $resp->assertDontSee('Dogcat');
+ }
+
+ public function test_page_markdown_export_converts_html_where_no_markdown()
+ {
+ $page = Page::query()->first()->forceFill([
+ 'markdown' => '',
+ 'html' => '<h1>Dogcat</h1><p>Some <strong>bold</strong> text</p>',
+ ]);
+ $page->save();
+
+ $resp = $this->asEditor()->get($page->getUrl('/export/markdown'));
+ $resp->assertSee("# Dogcat\n\nSome **bold** text");
+ }
+
+ public function test_page_markdown_export_does_not_convert_callouts()
+ {
+ $page = Page::query()->first()->forceFill([
+ 'markdown' => '',
+ 'html' => '<h1>Dogcat</h1><p class="callout info">Some callout text</p><p>Another line</p>',
+ ]);
+ $page->save();
+
+ $resp = $this->asEditor()->get($page->getUrl('/export/markdown'));
+ $resp->assertSee("# Dogcat\n\n<p class=\"callout info\">Some callout text</p>\n\nAnother line", false);
+ }
+
+ public function test_page_markdown_export_handles_bookstacks_wysiwyg_codeblock_format()
+ {
+ $page = Page::query()->first()->forceFill([
+ 'markdown' => '',
+ 'html' => '<h1>Dogcat</h1>' . "\r\n" . '<pre id="bkmrk-var-a-%3D-%27cat%27%3B"><code class="language-JavaScript">var a = \'cat\';</code></pre><p>Another line</p>',
+ ]);
+ $page->save();
+
+ $resp = $this->asEditor()->get($page->getUrl('/export/markdown'));
+ $resp->assertSee("# Dogcat\n\n```JavaScript\nvar a = 'cat';\n```\n\nAnother line", false);
projects / bookstack / blobdiff