BookStack Code Mirror - bookstack/blob - tests/Uploads/AttachmentTest.php

   1 <?php namespace Tests\Uploads;
   2
   3 use BookStack\Entities\Tools\TrashCan;
   4 use BookStack\Entities\Repos\PageRepo;
   5 use BookStack\Uploads\Attachment;
   6 use BookStack\Entities\Models\Page;
   7 use BookStack\Auth\Permissions\PermissionService;
   8 use BookStack\Uploads\AttachmentService;
   9 use Illuminate\Http\UploadedFile;
  10 use Tests\TestCase;
  11 use Tests\TestResponse;
  12
  13 class AttachmentTest extends TestCase
  14 {
  15     /**
  16      * Get a test file that can be uploaded
  17      */
  18     protected function getTestFile(string $fileName): UploadedFile
  19     {
  20         return new UploadedFile(base_path('tests/test-data/test-file.txt'), $fileName, 'text/plain', 55, null, true);
  21     }
  22
  23     /**
  24      * Uploads a file with the given name.
  25      */
  26     protected function uploadFile(string $name, int $uploadedTo = 0): \Illuminate\Foundation\Testing\TestResponse
  27     {
  28         $file = $this->getTestFile($name);
  29         return $this->call('POST', '/attachments/upload', ['uploaded_to' => $uploadedTo], [], ['file' => $file], []);
  30     }
  31
  32     /**
  33      * Create a new attachment
  34      */
  35     protected function createAttachment(Page $page): Attachment
  36     {
  37         $this->post('attachments/link', [
  38             'attachment_link_url' => 'https://example.com',
  39             'attachment_link_name' => 'Example Attachment Link',
  40             'attachment_link_uploaded_to' => $page->id,
  41         ]);
  42
  43         return Attachment::query()->latest()->first();
  44     }
  45
  46     /**
  47      * Delete all uploaded files.
  48      * To assist with cleanup.
  49      */
  50     protected function deleteUploads()
  51     {
  52         $fileService = $this->app->make(AttachmentService::class);
  53         foreach (Attachment::all() as $file) {
  54             $fileService->deleteFile($file);
  55         }
  56     }
  57
  58     public function test_file_upload()
  59     {
  60         $page = Page::first();
  61         $this->asAdmin();
  62         $admin = $this->getAdmin();
  63         $fileName = 'upload_test_file.txt';
  64
  65         $expectedResp = [
  66             'name' => $fileName,
  67             'uploaded_to'=> $page->id,
  68             'extension' => 'txt',
  69             'order' => 1,
  70             'created_by' => $admin->id,
  71             'updated_by' => $admin->id,
  72         ];
  73
  74         $upload = $this->uploadFile($fileName, $page->id);
  75         $upload->assertStatus(200);
  76
  77         $attachment = Attachment::query()->orderBy('id', 'desc')->first();
  78         $expectedResp['path'] = $attachment->path;
  79
  80         $upload->assertJson($expectedResp);
  81         $this->assertDatabaseHas('attachments', $expectedResp);
  82
  83         $this->deleteUploads();
  84     }
  85
  86     public function test_file_upload_does_not_use_filename()
  87     {
  88         $page = Page::first();
  89         $fileName = 'upload_test_file.txt';
  90
  91
  92         $upload = $this->asAdmin()->uploadFile($fileName, $page->id);
  93         $upload->assertStatus(200);
  94
  95         $attachment = Attachment::query()->orderBy('id', 'desc')->first();
  96         $this->assertStringNotContainsString($fileName, $attachment->path);
  97         $this->assertStringEndsWith('.txt', $attachment->path);
  98     }
  99
 100     public function test_file_display_and_access()
 101     {
 102         $page = Page::first();
 103         $this->asAdmin();
 104         $fileName = 'upload_test_file.txt';
 105
 106         $upload = $this->uploadFile($fileName, $page->id);
 107         $upload->assertStatus(200);
 108         $attachment = Attachment::orderBy('id', 'desc')->take(1)->first();
 109
 110         $pageGet = $this->get($page->getUrl());
 111         $pageGet->assertSeeText($fileName);
 112         $pageGet->assertSee($attachment->getUrl());
 113
 114         $attachmentGet = $this->get($attachment->getUrl());
 115         $attachmentGet->assertSee('Hi, This is a test file for testing the upload process.');
 116
 117         $this->deleteUploads();
 118     }
 119
 120     public function test_attaching_link_to_page()
 121     {
 122         $page = Page::first();
 123         $admin = $this->getAdmin();
 124         $this->asAdmin();
 125
 126         $linkReq = $this->call('POST', 'attachments/link', [
 127             'attachment_link_url' => 'https://example.com',
 128             'attachment_link_name' => 'Example Attachment Link',
 129             'attachment_link_uploaded_to' => $page->id,
 130         ]);
 131
 132         $expectedData = [
 133             'path' => 'https://example.com',
 134             'name' => 'Example Attachment Link',
 135             'uploaded_to' => $page->id,
 136             'created_by' => $admin->id,
 137             'updated_by' => $admin->id,
 138             'external' => true,
 139             'order' => 1,
 140             'extension' => ''
 141         ];
 142
 143         $linkReq->assertStatus(200);
 144         $this->assertDatabaseHas('attachments', $expectedData);
 145         $attachment = Attachment::orderBy('id', 'desc')->take(1)->first();
 146
 147         $pageGet = $this->get($page->getUrl());
 148         $pageGet->assertSeeText('Example Attachment Link');
 149         $pageGet->assertSee($attachment->getUrl());
 150
 151         $attachmentGet = $this->get($attachment->getUrl());
 152         $attachmentGet->assertRedirect('https://example.com');
 153
 154         $this->deleteUploads();
 155     }
 156
 157     public function test_attachment_updating()
 158     {
 159         $page = Page::first();
 160         $this->asAdmin();
 161
 162         $attachment = $this->createAttachment($page);
 163         $update = $this->call('PUT', 'attachments/' . $attachment->id, [
 164             'attachment_edit_name' => 'My new attachment name',
 165             'attachment_edit_url' => 'https://test.example.com'
 166         ]);
 167
 168         $expectedData = [
 169             'id' => $attachment->id,
 170             'path' => 'https://test.example.com',
 171             'name' => 'My new attachment name',
 172             'uploaded_to' => $page->id
 173         ];
 174
 175         $update->assertStatus(200);
 176         $this->assertDatabaseHas('attachments', $expectedData);
 177
 178         $this->deleteUploads();
 179     }
 180
 181     public function test_file_deletion()
 182     {
 183         $page = Page::first();
 184         $this->asAdmin();
 185         $fileName = 'deletion_test.txt';
 186         $this->uploadFile($fileName, $page->id);
 187
 188         $attachment = Attachment::query()->orderBy('id', 'desc')->first();
 189         $filePath = storage_path($attachment->path);
 190         $this->assertTrue(file_exists($filePath), 'File at path ' . $filePath . ' does not exist');
 191
 192         $attachment = Attachment::first();
 193         $this->delete($attachment->getUrl());
 194
 195         $this->assertDatabaseMissing('attachments', [
 196             'name' => $fileName
 197         ]);
 198         $this->assertFalse(file_exists($filePath), 'File at path ' . $filePath . ' was not deleted as expected');
 199
 200         $this->deleteUploads();
 201     }
 202
 203     public function test_attachment_deletion_on_page_deletion()
 204     {
 205         $page = Page::first();
 206         $this->asAdmin();
 207         $fileName = 'deletion_test.txt';
 208         $this->uploadFile($fileName, $page->id);
 209
 210         $attachment = Attachment::query()->orderBy('id', 'desc')->first();
 211         $filePath = storage_path($attachment->path);
 212
 213         $this->assertTrue(file_exists($filePath), 'File at path ' . $filePath . ' does not exist');
 214         $this->assertDatabaseHas('attachments', [
 215             'name' => $fileName
 216         ]);
 217
 218         app(PageRepo::class)->destroy($page);
 219         app(TrashCan::class)->empty();
 220
 221         $this->assertDatabaseMissing('attachments', [
 222             'name' => $fileName
 223         ]);
 224         $this->assertFalse(file_exists($filePath), 'File at path ' . $filePath . ' was not deleted as expected');
 225
 226         $this->deleteUploads();
 227     }
 228
 229     public function test_attachment_access_without_permission_shows_404()
 230     {
 231         $admin = $this->getAdmin();
 232         $viewer = $this->getViewer();
 233         $page = Page::first(); /** @var Page $page */
 234
 235         $this->actingAs($admin);
 236         $fileName = 'permission_test.txt';
 237         $this->uploadFile($fileName, $page->id);
 238         $attachment = Attachment::orderBy('id', 'desc')->take(1)->first();
 239
 240         $page->restricted = true;
 241         $page->permissions()->delete();
 242         $page->save();
 243         $page->rebuildPermissions();
 244         $page->load('jointPermissions');
 245
 246         $this->actingAs($viewer);
 247         $attachmentGet = $this->get($attachment->getUrl());
 248         $attachmentGet->assertStatus(404);
 249         $attachmentGet->assertSee("Attachment not found");
 250
 251         $this->deleteUploads();
 252     }
 253
 254     public function test_data_and_js_links_cannot_be_attached_to_a_page()
 255     {
 256         $page = Page::first();
 257         $this->asAdmin();
 258
 259         $badLinks = [
 260             'javascript:alert("bunny")',
 261             ' javascript:alert("bunny")',
 262             'JavaScript:alert("bunny")',
 263             "\t\n\t\nJavaScript:alert(\"bunny\")",
 264             "data:text/html;<a></a>",
 265             "Data:text/html;<a></a>",
 266             "Data:text/html;<a></a>",
 267         ];
 268
 269         foreach ($badLinks as $badLink) {
 270             $linkReq = $this->post('attachments/link', [
 271                 'attachment_link_url' => $badLink,
 272                 'attachment_link_name' => 'Example Attachment Link',
 273                 'attachment_link_uploaded_to' => $page->id,
 274             ]);
 275             $linkReq->assertStatus(422);
 276             $this->assertDatabaseMissing('attachments', [
 277                 'path' => $badLink,
 278             ]);
 279         }
 280
 281         $attachment = $this->createAttachment($page);
 282
 283         foreach ($badLinks as $badLink) {
 284             $linkReq = $this->put('attachments/' . $attachment->id, [
 285                 'attachment_edit_url' => $badLink,
 286                 'attachment_edit_name' => 'Example Attachment Link',
 287             ]);
 288             $linkReq->assertStatus(422);
 289             $this->assertDatabaseMissing('attachments', [
 290                 'path' => $badLink,
 291             ]);
 292         }
 293     }
 294 }