BookStack Code Mirror - bookstack/blobdiff - tests/Uploads/AttachmentTest.php

index 1ca9ea23b17d5d04101c2203173d394b3455b379..27a23bcaeed3d385ebce0dd27f31aa5f3ef12f5e 100644 (file)

--- a/tests/Uploads/AttachmentTest.php

+++ b/tests/Uploads/AttachmentTest.php

@@ -1,48 +1,64 @@

-<?php namespace Tests\Uploads;

+<?php

-use BookStack\Entities\Tools\TrashCan;

+namespace Tests\Uploads;

+use BookStack\Entities\Models\Page;

use BookStack\Entities\Repos\PageRepo;

+use BookStack\Entities\Tools\TrashCan;

use BookStack\Uploads\Attachment;

-use BookStack\Entities\Models\Page;

-use BookStack\Auth\Permissions\PermissionService;

use BookStack\Uploads\AttachmentService;

use Illuminate\Http\UploadedFile;

use Tests\TestCase;

use BookStack\Uploads\AttachmentService;

use Illuminate\Http\UploadedFile;

use Tests\TestCase;

-use Tests\TestResponse;

class AttachmentTest extends TestCase

{

/**

class AttachmentTest extends TestCase

{

/**

- * Get a test file that can be uploaded

+ * Get a test file that can be uploaded.

protected function getTestFile(string $fileName): UploadedFile

{

protected function getTestFile(string $fileName): UploadedFile

{

- return new UploadedFile(base_path('tests/test-data/test-file.txt'), $fileName, 'text/plain', 55, null, true);

+ return new UploadedFile(base_path('tests/test-data/test-file.txt'), $fileName, 'text/plain', null, true);

}

/**

* Uploads a file with the given name.

}

/**

* Uploads a file with the given name.

- protected function uploadFile(string $name, int $uploadedTo = 0): \Illuminate\Foundation\Testing\TestResponse

+ protected function uploadFile(string $name, int $uploadedTo = 0): \Illuminate\Testing\TestResponse

{

$file = $this->getTestFile($name);

{

$file = $this->getTestFile($name);

return $this->call('POST', '/attachments/upload', ['uploaded_to' => $uploadedTo], [], ['file' => $file], []);

}

/**

return $this->call('POST', '/attachments/upload', ['uploaded_to' => $uploadedTo], [], ['file' => $file], []);

}

/**

- * Create a new attachment

+ * Create a new attachment.

protected function createAttachment(Page $page): Attachment

{

$this->post('attachments/link', [

protected function createAttachment(Page $page): Attachment

{

$this->post('attachments/link', [

- 'attachment_link_url' => 'https://example.com',

- 'attachment_link_name' => 'Example Attachment Link',

+ 'attachment_link_url' => 'https://example.com',

+ 'attachment_link_name' => 'Example Attachment Link',

'attachment_link_uploaded_to' => $page->id,

]);

return Attachment::query()->latest()->first();

}

'attachment_link_uploaded_to' => $page->id,

]);

return Attachment::query()->latest()->first();

}

+ /**

+ * Create a new upload attachment from the given data.

+ */

+ protected function createUploadAttachment(Page $page, string $filename, string $content, string $mimeType): Attachment

+ {

+ $file = tmpfile();

+ $filePath = stream_get_meta_data($file)['uri'];

+ file_put_contents($filePath, $content);

+ $upload = new UploadedFile($filePath, $filename, $mimeType, null, true);

+ $this->call('POST', '/attachments/upload', ['uploaded_to' => $page->id], [], ['file' => $upload], []);

+ return $page->attachments()->latest()->firstOrFail();

+ }

/**

* Delete all uploaded files.

* To assist with cleanup.

/**

* Delete all uploaded files.

* To assist with cleanup.

@@ -57,16 +73,16 @@ class AttachmentTest extends TestCase

public function test_file_upload()

{

public function test_file_upload()

{

- $page = Page::first();

+ $page = Page::query()->first();

$this->asAdmin();

$admin = $this->getAdmin();

$fileName = 'upload_test_file.txt';

$expectedResp = [

$this->asAdmin();

$admin = $this->getAdmin();

$fileName = 'upload_test_file.txt';

$expectedResp = [

- 'name' => $fileName,

+ 'name' => $fileName,

'uploaded_to'=> $page->id,

- 'extension' => 'txt',

- 'order' => 1,

+ 'extension' => 'txt',

+ 'order' => 1,

'created_by' => $admin->id,

'updated_by' => $admin->id,

];

'created_by' => $admin->id,

'updated_by' => $admin->id,

];

@@ -75,9 +91,9 @@ class AttachmentTest extends TestCase

$upload->assertStatus(200);

$attachment = Attachment::query()->orderBy('id', 'desc')->first();

$upload->assertStatus(200);

$attachment = Attachment::query()->orderBy('id', 'desc')->first();

- $expectedResp['path'] = $attachment->path;

$upload->assertJson($expectedResp);

+ $expectedResp['path'] = $attachment->path;

$this->assertDatabaseHas('attachments', $expectedResp);

$this->deleteUploads();

$this->assertDatabaseHas('attachments', $expectedResp);

$this->deleteUploads();

@@ -85,21 +101,21 @@ class AttachmentTest extends TestCase

public function test_file_upload_does_not_use_filename()

{

public function test_file_upload_does_not_use_filename()

{

- $page = Page::first();

+ $page = Page::query()->first();

$fileName = 'upload_test_file.txt';

$upload = $this->asAdmin()->uploadFile($fileName, $page->id);

$upload->assertStatus(200);

$attachment = Attachment::query()->orderBy('id', 'desc')->first();

$this->assertStringNotContainsString($fileName, $attachment->path);

$upload = $this->asAdmin()->uploadFile($fileName, $page->id);

$upload->assertStatus(200);

$attachment = Attachment::query()->orderBy('id', 'desc')->first();

$this->assertStringNotContainsString($fileName, $attachment->path);

- $this->assertStringEndsWith('.txt', $attachment->path);

+ $this->assertStringEndsWith('-txt', $attachment->path);

+ $this->deleteUploads();

}

public function test_file_display_and_access()

{

}

public function test_file_display_and_access()

{

- $page = Page::first();

+ $page = Page::query()->first();

$this->asAdmin();

$fileName = 'upload_test_file.txt';

$this->asAdmin();

$fileName = 'upload_test_file.txt';

@@ -112,32 +128,33 @@ class AttachmentTest extends TestCase

$pageGet->assertSee($attachment->getUrl());

$attachmentGet = $this->get($attachment->getUrl());

$pageGet->assertSee($attachment->getUrl());

$attachmentGet = $this->get($attachment->getUrl());

- $attachmentGet->assertSee('Hi, This is a test file for testing the upload process.');

+ $content = $attachmentGet->streamedContent();

+ $this->assertStringContainsString('Hi, This is a test file for testing the upload process.', $content);

$this->deleteUploads();

}

public function test_attaching_link_to_page()

{

$this->deleteUploads();

}

public function test_attaching_link_to_page()

{

- $page = Page::first();

+ $page = Page::query()->first();

$admin = $this->getAdmin();

$this->asAdmin();

$linkReq = $this->call('POST', 'attachments/link', [

$admin = $this->getAdmin();

$this->asAdmin();

$linkReq = $this->call('POST', 'attachments/link', [

- 'attachment_link_url' => 'https://example.com',

- 'attachment_link_name' => 'Example Attachment Link',

+ 'attachment_link_url' => 'https://example.com',

+ 'attachment_link_name' => 'Example Attachment Link',

'attachment_link_uploaded_to' => $page->id,

]);

$expectedData = [

'attachment_link_uploaded_to' => $page->id,

]);

$expectedData = [

- 'path' => 'https://example.com',

- 'name' => 'Example Attachment Link',

+ 'path' => 'https://example.com',

+ 'name' => 'Example Attachment Link',

'uploaded_to' => $page->id,

- 'created_by' => $admin->id,

- 'updated_by' => $admin->id,

- 'external' => true,

- 'order' => 1,

- 'extension' => ''

+ 'created_by' => $admin->id,

+ 'updated_by' => $admin->id,

+ 'external' => true,

+ 'order' => 1,

+ 'extension' => '',

];

$linkReq->assertStatus(200);

];

$linkReq->assertStatus(200);

@@ -156,20 +173,20 @@ class AttachmentTest extends TestCase

public function test_attachment_updating()

{

public function test_attachment_updating()

{

- $page = Page::first();

+ $page = Page::query()->first();

$this->asAdmin();

$attachment = $this->createAttachment($page);

$update = $this->call('PUT', 'attachments/' . $attachment->id, [

'attachment_edit_name' => 'My new attachment name',

$this->asAdmin();

$attachment = $this->createAttachment($page);

$update = $this->call('PUT', 'attachments/' . $attachment->id, [

'attachment_edit_name' => 'My new attachment name',

- 'attachment_edit_url' => 'https://test.example.com'

+ 'attachment_edit_url' => 'https://test.example.com',

]);

$expectedData = [

]);

$expectedData = [

- 'id' => $attachment->id,

- 'path' => 'https://test.example.com',

- 'name' => 'My new attachment name',

- 'uploaded_to' => $page->id

+ 'id' => $attachment->id,

+ 'path' => 'https://test.example.com',

+ 'name' => 'My new attachment name',

+ 'uploaded_to' => $page->id,

];

$update->assertStatus(200);

];

$update->assertStatus(200);

@@ -180,7 +197,7 @@ class AttachmentTest extends TestCase

public function test_file_deletion()

{

public function test_file_deletion()

{

- $page = Page::first();

+ $page = Page::query()->first();

$this->asAdmin();

$fileName = 'deletion_test.txt';

$this->uploadFile($fileName, $page->id);

$this->asAdmin();

$fileName = 'deletion_test.txt';

$this->uploadFile($fileName, $page->id);

@@ -193,7 +210,7 @@ class AttachmentTest extends TestCase

$this->delete($attachment->getUrl());

$this->assertDatabaseMissing('attachments', [

$this->delete($attachment->getUrl());

$this->assertDatabaseMissing('attachments', [

- 'name' => $fileName

+ 'name' => $fileName,

]);

$this->assertFalse(file_exists($filePath), 'File at path ' . $filePath . ' was not deleted as expected');

]);

$this->assertFalse(file_exists($filePath), 'File at path ' . $filePath . ' was not deleted as expected');

@@ -202,7 +219,7 @@ class AttachmentTest extends TestCase

public function test_attachment_deletion_on_page_deletion()

{

public function test_attachment_deletion_on_page_deletion()

{

- $page = Page::first();

+ $page = Page::query()->first();

$this->asAdmin();

$fileName = 'deletion_test.txt';

$this->uploadFile($fileName, $page->id);

$this->asAdmin();

$fileName = 'deletion_test.txt';

$this->uploadFile($fileName, $page->id);

@@ -212,14 +229,14 @@ class AttachmentTest extends TestCase

$this->assertTrue(file_exists($filePath), 'File at path ' . $filePath . ' does not exist');

$this->assertDatabaseHas('attachments', [

$this->assertTrue(file_exists($filePath), 'File at path ' . $filePath . ' does not exist');

$this->assertDatabaseHas('attachments', [

- 'name' => $fileName

+ 'name' => $fileName,

]);

app(PageRepo::class)->destroy($page);

app(TrashCan::class)->empty();

$this->assertDatabaseMissing('attachments', [

]);

app(PageRepo::class)->destroy($page);

app(TrashCan::class)->empty();

$this->assertDatabaseMissing('attachments', [

- 'name' => $fileName

+ 'name' => $fileName,

]);

$this->assertFalse(file_exists($filePath), 'File at path ' . $filePath . ' was not deleted as expected');

]);

$this->assertFalse(file_exists($filePath), 'File at path ' . $filePath . ' was not deleted as expected');

@@ -230,8 +247,7 @@ class AttachmentTest extends TestCase

{

$admin = $this->getAdmin();

$viewer = $this->getViewer();

{

$admin = $this->getAdmin();

$viewer = $this->getViewer();

- $page = Page::first(); /** @var Page $page */

+ $page = Page::query()->first(); /** @var Page $page */

$this->actingAs($admin);

$fileName = 'permission_test.txt';

$this->uploadFile($fileName, $page->id);

$this->actingAs($admin);

$fileName = 'permission_test.txt';

$this->uploadFile($fileName, $page->id);

@@ -246,14 +262,14 @@ class AttachmentTest extends TestCase

$this->actingAs($viewer);

$attachmentGet = $this->get($attachment->getUrl());

$attachmentGet->assertStatus(404);

$this->actingAs($viewer);

$attachmentGet = $this->get($attachment->getUrl());

$attachmentGet->assertStatus(404);

- $attachmentGet->assertSee("Attachment not found");

+ $attachmentGet->assertSee('Attachment not found');

$this->deleteUploads();

}

public function test_data_and_js_links_cannot_be_attached_to_a_page()

{

$this->deleteUploads();

}

public function test_data_and_js_links_cannot_be_attached_to_a_page()

{

- $page = Page::first();

+ $page = Page::query()->first();

$this->asAdmin();

$badLinks = [

$this->asAdmin();

$badLinks = [

@@ -261,15 +277,15 @@ class AttachmentTest extends TestCase

' javascript:alert("bunny")',

'JavaScript:alert("bunny")',

"\t\n\t\nJavaScript:alert(\"bunny\")",

' javascript:alert("bunny")',

'JavaScript:alert("bunny")',

"\t\n\t\nJavaScript:alert(\"bunny\")",

- "data:text/html;<a></a>",

- "Data:text/html;<a></a>",

+ 'data:text/html;<a></a>',

+ 'Data:text/html;<a></a>',

];

foreach ($badLinks as $badLink) {

$linkReq = $this->post('attachments/link', [

];

foreach ($badLinks as $badLink) {

$linkReq = $this->post('attachments/link', [

- 'attachment_link_url' => $badLink,

- 'attachment_link_name' => 'Example Attachment Link',

+ 'attachment_link_url' => $badLink,

+ 'attachment_link_name' => 'Example Attachment Link',

'attachment_link_uploaded_to' => $page->id,

]);

$linkReq->assertStatus(422);

'attachment_link_uploaded_to' => $page->id,

]);

$linkReq->assertStatus(422);

@@ -282,7 +298,7 @@ class AttachmentTest extends TestCase

foreach ($badLinks as $badLink) {

$linkReq = $this->put('attachments/' . $attachment->id, [

foreach ($badLinks as $badLink) {

$linkReq = $this->put('attachments/' . $attachment->id, [

- 'attachment_edit_url' => $badLink,

+ 'attachment_edit_url' => $badLink,

'attachment_edit_name' => 'Example Attachment Link',

]);

$linkReq->assertStatus(422);

'attachment_edit_name' => 'Example Attachment Link',

]);

$linkReq->assertStatus(422);

@@ -291,4 +307,38 @@ class AttachmentTest extends TestCase

]);

}

]);

}

+ public function test_file_access_with_open_query_param_provides_inline_response_with_correct_content_type()

+ {

+ $page = Page::query()->first();

+ $this->asAdmin();

+ $fileName = 'upload_test_file.txt';

+ $upload = $this->uploadFile($fileName, $page->id);

+ $upload->assertStatus(200);

+ $attachment = Attachment::query()->orderBy('id', 'desc')->take(1)->first();

+ $attachmentGet = $this->get($attachment->getUrl(true));

+ // http-foundation/Response does some 'fixing' of responses to add charsets to text responses.

+ $attachmentGet->assertHeader('Content-Type', 'text/plain; charset=UTF-8');

+ $attachmentGet->assertHeader('Content-Disposition', 'inline; filename="upload_test_file.txt"');

+ $attachmentGet->assertHeader('X-Content-Type-Options', 'nosniff');

+ $this->deleteUploads();

+ }

+ public function test_html_file_access_with_open_forces_plain_content_type()

+ {

+ $page = Page::query()->first();

+ $this->asAdmin();

+ $attachment = $this->createUploadAttachment($page, 'test_file.html', '<html></html><p>testing</p>', 'text/html');

+ $attachmentGet = $this->get($attachment->getUrl(true));

+ // http-foundation/Response does some 'fixing' of responses to add charsets to text responses.

+ $attachmentGet->assertHeader('Content-Type', 'text/plain; charset=UTF-8');

+ $attachmentGet->assertHeader('Content-Disposition', 'inline; filename="test_file.html"');

+ $this->deleteUploads();

+ }

}