BookStack Code Mirror - bookstack/blob - tests/Entity/ExportTest.php

   1 <?php
   2
   3 namespace Tests\Entity;
   4
   5 use BookStack\Entities\Models\Book;
   6 use BookStack\Entities\Models\Chapter;
   7 use BookStack\Entities\Models\Page;
   8 use BookStack\Entities\Tools\PdfGenerator;
   9 use Illuminate\Support\Facades\Storage;
  10 use Illuminate\Support\Str;
  11 use Tests\TestCase;
  12
  13 class ExportTest extends TestCase
  14 {
  15     public function test_page_text_export()
  16     {
  17         $page = $this->entities->page();
  18         $this->asEditor();
  19
  20         $resp = $this->get($page->getUrl('/export/plaintext'));
  21         $resp->assertStatus(200);
  22         $resp->assertSee($page->name);
  23         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.txt"');
  24     }
  25
  26     public function test_page_pdf_export()
  27     {
  28         $page = $this->entities->page();
  29         $this->asEditor();
  30
  31         $resp = $this->get($page->getUrl('/export/pdf'));
  32         $resp->assertStatus(200);
  33         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.pdf"');
  34     }
  35
  36     public function test_page_html_export()
  37     {
  38         $page = $this->entities->page();
  39         $this->asEditor();
  40
  41         $resp = $this->get($page->getUrl('/export/html'));
  42         $resp->assertStatus(200);
  43         $resp->assertSee($page->name);
  44         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.html"');
  45     }
  46
  47     public function test_book_text_export()
  48     {
  49         $page = $this->entities->page();
  50         $book = $page->book;
  51         $this->asEditor();
  52
  53         $resp = $this->get($book->getUrl('/export/plaintext'));
  54         $resp->assertStatus(200);
  55         $resp->assertSee($book->name);
  56         $resp->assertSee($page->name);
  57         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $book->slug . '.txt"');
  58     }
  59
  60     public function test_book_pdf_export()
  61     {
  62         $page = $this->entities->page();
  63         $book = $page->book;
  64         $this->asEditor();
  65
  66         $resp = $this->get($book->getUrl('/export/pdf'));
  67         $resp->assertStatus(200);
  68         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $book->slug . '.pdf"');
  69     }
  70
  71     public function test_book_html_export()
  72     {
  73         $page = $this->entities->page();
  74         $book = $page->book;
  75         $this->asEditor();
  76
  77         $resp = $this->get($book->getUrl('/export/html'));
  78         $resp->assertStatus(200);
  79         $resp->assertSee($book->name);
  80         $resp->assertSee($page->name);
  81         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $book->slug . '.html"');
  82     }
  83
  84     public function test_book_html_export_shows_chapter_descriptions()
  85     {
  86         $chapterDesc = 'My custom test chapter description ' . Str::random(12);
  87         $chapter = $this->entities->chapter();
  88         $chapter->description = $chapterDesc;
  89         $chapter->save();
  90
  91         $book = $chapter->book;
  92         $this->asEditor();
  93
  94         $resp = $this->get($book->getUrl('/export/html'));
  95         $resp->assertSee($chapterDesc);
  96     }
  97
  98     public function test_chapter_text_export()
  99     {
 100         $chapter = $this->entities->chapter();
 101         $page = $chapter->pages[0];
 102         $this->asEditor();
 103
 104         $resp = $this->get($chapter->getUrl('/export/plaintext'));
 105         $resp->assertStatus(200);
 106         $resp->assertSee($chapter->name);
 107         $resp->assertSee($page->name);
 108         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $chapter->slug . '.txt"');
 109     }
 110
 111     public function test_chapter_pdf_export()
 112     {
 113         $chapter = $this->entities->chapter();
 114         $this->asEditor();
 115
 116         $resp = $this->get($chapter->getUrl('/export/pdf'));
 117         $resp->assertStatus(200);
 118         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $chapter->slug . '.pdf"');
 119     }
 120
 121     public function test_chapter_html_export()
 122     {
 123         $chapter = $this->entities->chapter();
 124         $page = $chapter->pages[0];
 125         $this->asEditor();
 126
 127         $resp = $this->get($chapter->getUrl('/export/html'));
 128         $resp->assertStatus(200);
 129         $resp->assertSee($chapter->name);
 130         $resp->assertSee($page->name);
 131         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $chapter->slug . '.html"');
 132     }
 133
 134     public function test_page_html_export_contains_custom_head_if_set()
 135     {
 136         $page = $this->entities->page();
 137
 138         $customHeadContent = '<style>p{color: red;}</style>';
 139         $this->setSettings(['app-custom-head' => $customHeadContent]);
 140
 141         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 142         $resp->assertSee($customHeadContent, false);
 143     }
 144
 145     public function test_page_html_export_does_not_break_with_only_comments_in_custom_head()
 146     {
 147         $page = $this->entities->page();
 148
 149         $customHeadContent = '<!-- A comment -->';
 150         $this->setSettings(['app-custom-head' => $customHeadContent]);
 151
 152         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 153         $resp->assertStatus(200);
 154         $resp->assertSee($customHeadContent, false);
 155     }
 156
 157     public function test_page_html_export_use_absolute_dates()
 158     {
 159         $page = $this->entities->page();
 160
 161         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 162         $resp->assertSee($page->created_at->isoFormat('D MMMM Y HH:mm:ss'));
 163         $resp->assertDontSee($page->created_at->diffForHumans());
 164         $resp->assertSee($page->updated_at->isoFormat('D MMMM Y HH:mm:ss'));
 165         $resp->assertDontSee($page->updated_at->diffForHumans());
 166     }
 167
 168     public function test_page_export_does_not_include_user_or_revision_links()
 169     {
 170         $page = $this->entities->page();
 171
 172         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 173         $resp->assertDontSee($page->getUrl('/revisions'));
 174         $resp->assertDontSee($page->createdBy->getProfileUrl());
 175         $resp->assertSee($page->createdBy->name);
 176     }
 177
 178     public function test_page_export_sets_right_data_type_for_svg_embeds()
 179     {
 180         $page = $this->entities->page();
 181         Storage::disk('local')->makeDirectory('uploads/images/gallery');
 182         Storage::disk('local')->put('uploads/images/gallery/svg_test.svg', '<svg></svg>');
 183         $page->html = '<img src="http://localhost/uploads/images/gallery/svg_test.svg">';
 184         $page->save();
 185
 186         $this->asEditor();
 187         $resp = $this->get($page->getUrl('/export/html'));
 188         Storage::disk('local')->delete('uploads/images/gallery/svg_test.svg');
 189
 190         $resp->assertStatus(200);
 191         $resp->assertSee('<img src="data:image/svg+xml;base64', false);
 192     }
 193
 194     public function test_page_image_containment_works_on_multiple_images_within_a_single_line()
 195     {
 196         $page = $this->entities->page();
 197         Storage::disk('local')->makeDirectory('uploads/images/gallery');
 198         Storage::disk('local')->put('uploads/images/gallery/svg_test.svg', '<svg></svg>');
 199         Storage::disk('local')->put('uploads/images/gallery/svg_test2.svg', '<svg></svg>');
 200         $page->html = '<img src="http://localhost/uploads/images/gallery/svg_test.svg" class="a"><img src="http://localhost/uploads/images/gallery/svg_test2.svg" class="b">';
 201         $page->save();
 202
 203         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 204         Storage::disk('local')->delete('uploads/images/gallery/svg_test.svg');
 205         Storage::disk('local')->delete('uploads/images/gallery/svg_test2.svg');
 206
 207         $resp->assertDontSee('http://localhost/uploads/images/gallery/svg_test');
 208     }
 209
 210     public function test_page_export_contained_html_image_fetches_only_run_when_url_points_to_image_upload_folder()
 211     {
 212         $page = $this->entities->page();
 213         $page->html = '<img src="http://localhost/uploads/images/gallery/svg_test.svg"/>'
 214             . '<img src="http://localhost/uploads/svg_test.svg"/>'
 215             . '<img src="/uploads/svg_test.svg"/>';
 216         $storageDisk = Storage::disk('local');
 217         $storageDisk->makeDirectory('uploads/images/gallery');
 218         $storageDisk->put('uploads/images/gallery/svg_test.svg', '<svg>good</svg>');
 219         $storageDisk->put('uploads/svg_test.svg', '<svg>bad</svg>');
 220         $page->save();
 221
 222         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 223
 224         $storageDisk->delete('uploads/images/gallery/svg_test.svg');
 225         $storageDisk->delete('uploads/svg_test.svg');
 226
 227         $resp->assertDontSee('http://localhost/uploads/images/gallery/svg_test.svg', false);
 228         $resp->assertSee('http://localhost/uploads/svg_test.svg');
 229         $resp->assertSee('src="/uploads/svg_test.svg"', false);
 230     }
 231
 232     public function test_page_export_contained_html_does_not_allow_upward_traversal_with_local()
 233     {
 234         $contents = file_get_contents(public_path('.htaccess'));
 235         config()->set('filesystems.images', 'local');
 236
 237         $page = $this->entities->page();
 238         $page->html = '<img src="http://localhost/uploads/images/../../.htaccess"/>';
 239         $page->save();
 240
 241         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 242         $resp->assertDontSee(base64_encode($contents));
 243     }
 244
 245     public function test_page_export_contained_html_does_not_allow_upward_traversal_with_local_secure()
 246     {
 247         $testFilePath = storage_path('logs/test.txt');
 248         config()->set('filesystems.images', 'local_secure');
 249         file_put_contents($testFilePath, 'I am a cat');
 250
 251         $page = $this->entities->page();
 252         $page->html = '<img src="http://localhost/uploads/images/../../logs/test.txt"/>';
 253         $page->save();
 254
 255         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 256         $resp->assertDontSee(base64_encode('I am a cat'));
 257         unlink($testFilePath);
 258     }
 259
 260     public function test_exports_removes_scripts_from_custom_head()
 261     {
 262         $entities = [
 263             Page::query()->first(), Chapter::query()->first(), Book::query()->first(),
 264         ];
 265         setting()->put('app-custom-head', '<script>window.donkey = "cat";</script><style>.my-test-class { color: red; }</style>');
 266
 267         foreach ($entities as $entity) {
 268             $resp = $this->asEditor()->get($entity->getUrl('/export/html'));
 269             $resp->assertDontSee('window.donkey');
 270             $resp->assertDontSee('<script', false);
 271             $resp->assertSee('.my-test-class { color: red; }');
 272         }
 273     }
 274
 275     public function test_page_export_with_deleted_creator_and_updater()
 276     {
 277         $user = $this->users->viewer(['name' => 'ExportWizardTheFifth']);
 278         $page = $this->entities->page();
 279         $page->created_by = $user->id;
 280         $page->updated_by = $user->id;
 281         $page->save();
 282
 283         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 284         $resp->assertSee('ExportWizardTheFifth');
 285
 286         $user->delete();
 287         $resp = $this->get($page->getUrl('/export/html'));
 288         $resp->assertStatus(200);
 289         $resp->assertDontSee('ExportWizardTheFifth');
 290     }
 291
 292     public function test_page_pdf_export_converts_iframes_to_links()
 293     {
 294         $page = Page::query()->first()->forceFill([
 295             'html'     => '<iframe width="560" height="315" src="//www.youtube.com/embed/ShqUjt33uOs"></iframe>',
 296         ]);
 297         $page->save();
 298
 299         $pdfHtml = '';
 300         $mockPdfGenerator = $this->mock(PdfGenerator::class);
 301         $mockPdfGenerator->shouldReceive('fromHtml')
 302             ->with(\Mockery::capture($pdfHtml))
 303             ->andReturn('');
 304         $mockPdfGenerator->shouldReceive('getActiveEngine')->andReturn(PdfGenerator::ENGINE_DOMPDF);
 305
 306         $this->asEditor()->get($page->getUrl('/export/pdf'));
 307         $this->assertStringNotContainsString('iframe>', $pdfHtml);
 308         $this->assertStringContainsString('<p><a href="https://www.youtube.com/embed/ShqUjt33uOs">https://www.youtube.com/embed/ShqUjt33uOs</a></p>', $pdfHtml);
 309     }
 310
 311     public function test_page_pdf_export_opens_details_blocks()
 312     {
 313         $page = $this->entities->page()->forceFill([
 314             'html'     => '<details><summary>Hello</summary><p>Content!</p></details>',
 315         ]);
 316         $page->save();
 317
 318         $pdfHtml = '';
 319         $mockPdfGenerator = $this->mock(PdfGenerator::class);
 320         $mockPdfGenerator->shouldReceive('fromHtml')
 321             ->with(\Mockery::capture($pdfHtml))
 322             ->andReturn('');
 323         $mockPdfGenerator->shouldReceive('getActiveEngine')->andReturn(PdfGenerator::ENGINE_DOMPDF);
 324
 325         $this->asEditor()->get($page->getUrl('/export/pdf'));
 326         $this->assertStringContainsString('<details open="open"', $pdfHtml);
 327     }
 328
 329     public function test_page_markdown_export()
 330     {
 331         $page = $this->entities->page();
 332
 333         $resp = $this->asEditor()->get($page->getUrl('/export/markdown'));
 334         $resp->assertStatus(200);
 335         $resp->assertSee($page->name);
 336         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.md"');
 337     }
 338
 339     public function test_page_markdown_export_uses_existing_markdown_if_apparent()
 340     {
 341         $page = $this->entities->page()->forceFill([
 342             'markdown' => '# A header',
 343             'html'     => '<h1>Dogcat</h1>',
 344         ]);
 345         $page->save();
 346
 347         $resp = $this->asEditor()->get($page->getUrl('/export/markdown'));
 348         $resp->assertSee('A header');
 349         $resp->assertDontSee('Dogcat');
 350     }
 351
 352     public function test_page_markdown_export_converts_html_where_no_markdown()
 353     {
 354         $page = $this->entities->page()->forceFill([
 355             'markdown' => '',
 356             'html'     => '<h1>Dogcat</h1><p>Some <strong>bold</strong> text</p>',
 357         ]);
 358         $page->save();
 359
 360         $resp = $this->asEditor()->get($page->getUrl('/export/markdown'));
 361         $resp->assertSee("# Dogcat\n\nSome **bold** text");
 362     }
 363
 364     public function test_chapter_markdown_export()
 365     {
 366         $chapter = $this->entities->chapter();
 367         $page = $chapter->pages()->first();
 368         $resp = $this->asEditor()->get($chapter->getUrl('/export/markdown'));
 369
 370         $resp->assertSee('# ' . $chapter->name);
 371         $resp->assertSee('# ' . $page->name);
 372     }
 373
 374     public function test_book_markdown_export()
 375     {
 376         $book = Book::query()->whereHas('pages')->whereHas('chapters')->first();
 377         $chapter = $book->chapters()->first();
 378         $page = $chapter->pages()->first();
 379         $resp = $this->asEditor()->get($book->getUrl('/export/markdown'));
 380
 381         $resp->assertSee('# ' . $book->name);
 382         $resp->assertSee('# ' . $chapter->name);
 383         $resp->assertSee('# ' . $page->name);
 384     }
 385
 386     public function test_book_markdown_export_concats_immediate_pages_with_newlines()
 387     {
 388         /** @var Book $book */
 389         $book = Book::query()->whereHas('pages')->first();
 390
 391         $this->asEditor()->get($book->getUrl('/create-page'));
 392         $this->get($book->getUrl('/create-page'));
 393
 394         [$pageA, $pageB] = $book->pages()->where('chapter_id', '=', 0)->get();
 395         $pageA->html = '<p>hello tester</p>';
 396         $pageA->save();
 397         $pageB->name = 'The second page in this test';
 398         $pageB->save();
 399
 400         $resp = $this->get($book->getUrl('/export/markdown'));
 401         $resp->assertDontSee('hello tester# The second page in this test');
 402         $resp->assertSee("hello tester\n\n# The second page in this test");
 403     }
 404
 405     public function test_export_option_only_visible_and_accessible_with_permission()
 406     {
 407         $book = Book::query()->whereHas('pages')->whereHas('chapters')->first();
 408         $chapter = $book->chapters()->first();
 409         $page = $chapter->pages()->first();
 410         $entities = [$book, $chapter, $page];
 411         $user = $this->users->viewer();
 412         $this->actingAs($user);
 413
 414         foreach ($entities as $entity) {
 415             $resp = $this->get($entity->getUrl());
 416             $resp->assertSee('/export/pdf');
 417         }
 418
 419         $this->permissions->removeUserRolePermissions($user, ['content-export']);
 420
 421         foreach ($entities as $entity) {
 422             $resp = $this->get($entity->getUrl());
 423             $resp->assertDontSee('/export/pdf');
 424             $resp = $this->get($entity->getUrl('/export/pdf'));
 425             $this->assertPermissionError($resp);
 426         }
 427     }
 428
 429     public function test_wkhtmltopdf_only_used_when_allow_untrusted_is_true()
 430     {
 431         $page = $this->entities->page();
 432
 433         config()->set('snappy.pdf.binary', '/abc123');
 434         config()->set('app.allow_untrusted_server_fetching', false);
 435
 436         $resp = $this->asEditor()->get($page->getUrl('/export/pdf'));
 437         $resp->assertStatus(200); // Sucessful response with invalid snappy binary indicates dompdf usage.
 438
 439         config()->set('app.allow_untrusted_server_fetching', true);
 440         $resp = $this->get($page->getUrl('/export/pdf'));
 441         $resp->assertStatus(500); // Bad response indicates wkhtml usage
 442     }
 443
 444     public function test_html_exports_contain_csp_meta_tag()
 445     {
 446         $entities = [
 447             $this->entities->page(),
 448             $this->entities->book(),
 449             $this->entities->chapter(),
 450         ];
 451
 452         foreach ($entities as $entity) {
 453             $resp = $this->asEditor()->get($entity->getUrl('/export/html'));
 454             $this->withHtml($resp)->assertElementExists('head meta[http-equiv="Content-Security-Policy"][content*="script-src "]');
 455         }
 456     }
 457
 458     public function test_html_exports_contain_body_classes_for_export_identification()
 459     {
 460         $page = $this->entities->page();
 461
 462         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 463         $this->withHtml($resp)->assertElementExists('body.export.export-format-html.export-engine-none');
 464     }
 465 }