BookStack Code Mirror - bookstack/blob - tests/Entity/ExportTest.php

   1 <?php
   2
   3 namespace Tests\Entity;
   4
   5 use BookStack\Entities\Models\Book;
   6 use BookStack\Entities\Models\Chapter;
   7 use BookStack\Entities\Models\Page;
   8 use BookStack\Entities\Tools\PdfGenerator;
   9 use Illuminate\Support\Facades\Storage;
  10 use Illuminate\Support\Str;
  11 use Tests\TestCase;
  12
  13 class ExportTest extends TestCase
  14 {
  15     public function test_page_text_export()
  16     {
  17         $page = $this->entities->page();
  18         $this->asEditor();
  19
  20         $resp = $this->get($page->getUrl('/export/plaintext'));
  21         $resp->assertStatus(200);
  22         $resp->assertSee($page->name);
  23         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.txt"');
  24     }
  25
  26     public function test_page_pdf_export()
  27     {
  28         $page = $this->entities->page();
  29         $this->asEditor();
  30
  31         $resp = $this->get($page->getUrl('/export/pdf'));
  32         $resp->assertStatus(200);
  33         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.pdf"');
  34     }
  35
  36     public function test_page_html_export()
  37     {
  38         $page = $this->entities->page();
  39         $this->asEditor();
  40
  41         $resp = $this->get($page->getUrl('/export/html'));
  42         $resp->assertStatus(200);
  43         $resp->assertSee($page->name);
  44         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.html"');
  45     }
  46
  47     public function test_book_text_export()
  48     {
  49         $book = $this->entities->bookHasChaptersAndPages();
  50         $directPage = $book->directPages()->first();
  51         $chapter = $book->chapters()->first();
  52         $chapterPage = $chapter->pages()->first();
  53         $this->entities->updatePage($directPage, ['html' => '<p>My awesome page</p>']);
  54         $this->entities->updatePage($chapterPage, ['html' => '<p>My little nested page</p>']);
  55         $this->asEditor();
  56
  57         $resp = $this->get($book->getUrl('/export/plaintext'));
  58         $resp->assertStatus(200);
  59         $resp->assertSee($book->name);
  60         $resp->assertSee($chapterPage->name);
  61         $resp->assertSee($chapter->name);
  62         $resp->assertSee($directPage->name);
  63         $resp->assertSee('My awesome page');
  64         $resp->assertSee('My little nested page');
  65         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $book->slug . '.txt"');
  66     }
  67
  68     public function test_book_text_export_format()
  69     {
  70         $entities = $this->entities->createChainBelongingToUser($this->users->viewer());
  71         $this->entities->updatePage($entities['page'], ['html' => '<p>My great page</p><p>Full of <strong>great</strong> stuff</p>', 'name' => 'My wonderful page!']);
  72         $entities['chapter']->name = 'Export chapter';
  73         $entities['chapter']->description = "A test chapter to be exported\nIt has loads of info within";
  74         $entities['book']->name = 'Export Book';
  75         $entities['book']->description = "This is a book with stuff to export";
  76         $entities['chapter']->save();
  77         $entities['book']->save();
  78
  79         $resp = $this->asEditor()->get($entities['book']->getUrl('/export/plaintext'));
  80
  81         $expected = "Export Book\nThis is a book with stuff to export\n\nExport chapter\nA test chapter to be exported\nIt has loads of info within\n\n";
  82         $expected .= "My wonderful page!\nMy great page Full of great stuff";
  83         $resp->assertSee($expected);
  84     }
  85
  86     public function test_book_pdf_export()
  87     {
  88         $page = $this->entities->page();
  89         $book = $page->book;
  90         $this->asEditor();
  91
  92         $resp = $this->get($book->getUrl('/export/pdf'));
  93         $resp->assertStatus(200);
  94         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $book->slug . '.pdf"');
  95     }
  96
  97     public function test_book_html_export()
  98     {
  99         $page = $this->entities->page();
 100         $book = $page->book;
 101         $this->asEditor();
 102
 103         $resp = $this->get($book->getUrl('/export/html'));
 104         $resp->assertStatus(200);
 105         $resp->assertSee($book->name);
 106         $resp->assertSee($page->name);
 107         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $book->slug . '.html"');
 108     }
 109
 110     public function test_book_html_export_shows_chapter_descriptions()
 111     {
 112         $chapterDesc = 'My custom test chapter description ' . Str::random(12);
 113         $chapter = $this->entities->chapter();
 114         $chapter->description = $chapterDesc;
 115         $chapter->save();
 116
 117         $book = $chapter->book;
 118         $this->asEditor();
 119
 120         $resp = $this->get($book->getUrl('/export/html'));
 121         $resp->assertSee($chapterDesc);
 122     }
 123
 124     public function test_chapter_text_export()
 125     {
 126         $chapter = $this->entities->chapter();
 127         $page = $chapter->pages[0];
 128         $this->entities->updatePage($page, ['html' => '<p>This is content within the page!</p>']);
 129         $this->asEditor();
 130
 131         $resp = $this->get($chapter->getUrl('/export/plaintext'));
 132         $resp->assertStatus(200);
 133         $resp->assertSee($chapter->name);
 134         $resp->assertSee($page->name);
 135         $resp->assertSee('This is content within the page!');
 136         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $chapter->slug . '.txt"');
 137     }
 138
 139     public function test_chapter_text_export_format()
 140     {
 141         $entities = $this->entities->createChainBelongingToUser($this->users->viewer());
 142         $this->entities->updatePage($entities['page'], ['html' => '<p>My great page</p><p>Full of <strong>great</strong> stuff</p>', 'name' => 'My wonderful page!']);
 143         $entities['chapter']->name = 'Export chapter';
 144         $entities['chapter']->description = "A test chapter to be exported\nIt has loads of info within";
 145         $entities['chapter']->save();
 146
 147         $resp = $this->asEditor()->get($entities['book']->getUrl('/export/plaintext'));
 148
 149         $expected = "Export chapter\nA test chapter to be exported\nIt has loads of info within\n\n";
 150         $expected .= "My wonderful page!\nMy great page Full of great stuff";
 151         $resp->assertSee($expected);
 152     }
 153
 154     public function test_chapter_pdf_export()
 155     {
 156         $chapter = $this->entities->chapter();
 157         $this->asEditor();
 158
 159         $resp = $this->get($chapter->getUrl('/export/pdf'));
 160         $resp->assertStatus(200);
 161         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $chapter->slug . '.pdf"');
 162     }
 163
 164     public function test_chapter_html_export()
 165     {
 166         $chapter = $this->entities->chapter();
 167         $page = $chapter->pages[0];
 168         $this->asEditor();
 169
 170         $resp = $this->get($chapter->getUrl('/export/html'));
 171         $resp->assertStatus(200);
 172         $resp->assertSee($chapter->name);
 173         $resp->assertSee($page->name);
 174         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $chapter->slug . '.html"');
 175     }
 176
 177     public function test_page_html_export_contains_custom_head_if_set()
 178     {
 179         $page = $this->entities->page();
 180
 181         $customHeadContent = '<style>p{color: red;}</style>';
 182         $this->setSettings(['app-custom-head' => $customHeadContent]);
 183
 184         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 185         $resp->assertSee($customHeadContent, false);
 186     }
 187
 188     public function test_page_html_export_does_not_break_with_only_comments_in_custom_head()
 189     {
 190         $page = $this->entities->page();
 191
 192         $customHeadContent = '<!-- A comment -->';
 193         $this->setSettings(['app-custom-head' => $customHeadContent]);
 194
 195         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 196         $resp->assertStatus(200);
 197         $resp->assertSee($customHeadContent, false);
 198     }
 199
 200     public function test_page_html_export_use_absolute_dates()
 201     {
 202         $page = $this->entities->page();
 203
 204         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 205         $resp->assertSee($page->created_at->isoFormat('D MMMM Y HH:mm:ss'));
 206         $resp->assertDontSee($page->created_at->diffForHumans());
 207         $resp->assertSee($page->updated_at->isoFormat('D MMMM Y HH:mm:ss'));
 208         $resp->assertDontSee($page->updated_at->diffForHumans());
 209     }
 210
 211     public function test_page_export_does_not_include_user_or_revision_links()
 212     {
 213         $page = $this->entities->page();
 214
 215         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 216         $resp->assertDontSee($page->getUrl('/revisions'));
 217         $resp->assertDontSee($page->createdBy->getProfileUrl());
 218         $resp->assertSee($page->createdBy->name);
 219     }
 220
 221     public function test_page_export_sets_right_data_type_for_svg_embeds()
 222     {
 223         $page = $this->entities->page();
 224         Storage::disk('local')->makeDirectory('uploads/images/gallery');
 225         Storage::disk('local')->put('uploads/images/gallery/svg_test.svg', '<svg></svg>');
 226         $page->html = '<img src="http://localhost/uploads/images/gallery/svg_test.svg">';
 227         $page->save();
 228
 229         $this->asEditor();
 230         $resp = $this->get($page->getUrl('/export/html'));
 231         Storage::disk('local')->delete('uploads/images/gallery/svg_test.svg');
 232
 233         $resp->assertStatus(200);
 234         $resp->assertSee('<img src="data:image/svg+xml;base64', false);
 235     }
 236
 237     public function test_page_image_containment_works_on_multiple_images_within_a_single_line()
 238     {
 239         $page = $this->entities->page();
 240         Storage::disk('local')->makeDirectory('uploads/images/gallery');
 241         Storage::disk('local')->put('uploads/images/gallery/svg_test.svg', '<svg></svg>');
 242         Storage::disk('local')->put('uploads/images/gallery/svg_test2.svg', '<svg></svg>');
 243         $page->html = '<img src="http://localhost/uploads/images/gallery/svg_test.svg" class="a"><img src="http://localhost/uploads/images/gallery/svg_test2.svg" class="b">';
 244         $page->save();
 245
 246         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 247         Storage::disk('local')->delete('uploads/images/gallery/svg_test.svg');
 248         Storage::disk('local')->delete('uploads/images/gallery/svg_test2.svg');
 249
 250         $resp->assertDontSee('http://localhost/uploads/images/gallery/svg_test');
 251     }
 252
 253     public function test_page_export_contained_html_image_fetches_only_run_when_url_points_to_image_upload_folder()
 254     {
 255         $page = $this->entities->page();
 256         $page->html = '<img src="http://localhost/uploads/images/gallery/svg_test.svg"/>'
 257             . '<img src="http://localhost/uploads/svg_test.svg"/>'
 258             . '<img src="/uploads/svg_test.svg"/>';
 259         $storageDisk = Storage::disk('local');
 260         $storageDisk->makeDirectory('uploads/images/gallery');
 261         $storageDisk->put('uploads/images/gallery/svg_test.svg', '<svg>good</svg>');
 262         $storageDisk->put('uploads/svg_test.svg', '<svg>bad</svg>');
 263         $page->save();
 264
 265         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 266
 267         $storageDisk->delete('uploads/images/gallery/svg_test.svg');
 268         $storageDisk->delete('uploads/svg_test.svg');
 269
 270         $resp->assertDontSee('http://localhost/uploads/images/gallery/svg_test.svg', false);
 271         $resp->assertSee('http://localhost/uploads/svg_test.svg');
 272         $resp->assertSee('src="/uploads/svg_test.svg"', false);
 273     }
 274
 275     public function test_page_export_contained_html_does_not_allow_upward_traversal_with_local()
 276     {
 277         $contents = file_get_contents(public_path('.htaccess'));
 278         config()->set('filesystems.images', 'local');
 279
 280         $page = $this->entities->page();
 281         $page->html = '<img src="http://localhost/uploads/images/../../.htaccess"/>';
 282         $page->save();
 283
 284         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 285         $resp->assertDontSee(base64_encode($contents));
 286     }
 287
 288     public function test_page_export_contained_html_does_not_allow_upward_traversal_with_local_secure()
 289     {
 290         $testFilePath = storage_path('logs/test.txt');
 291         config()->set('filesystems.images', 'local_secure');
 292         file_put_contents($testFilePath, 'I am a cat');
 293
 294         $page = $this->entities->page();
 295         $page->html = '<img src="http://localhost/uploads/images/../../logs/test.txt"/>';
 296         $page->save();
 297
 298         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 299         $resp->assertDontSee(base64_encode('I am a cat'));
 300         unlink($testFilePath);
 301     }
 302
 303     public function test_exports_removes_scripts_from_custom_head()
 304     {
 305         $entities = [
 306             Page::query()->first(), Chapter::query()->first(), Book::query()->first(),
 307         ];
 308         setting()->put('app-custom-head', '<script>window.donkey = "cat";</script><style>.my-test-class { color: red; }</style>');
 309
 310         foreach ($entities as $entity) {
 311             $resp = $this->asEditor()->get($entity->getUrl('/export/html'));
 312             $resp->assertDontSee('window.donkey');
 313             $resp->assertDontSee('<script', false);
 314             $resp->assertSee('.my-test-class { color: red; }');
 315         }
 316     }
 317
 318     public function test_page_export_with_deleted_creator_and_updater()
 319     {
 320         $user = $this->users->viewer(['name' => 'ExportWizardTheFifth']);
 321         $page = $this->entities->page();
 322         $page->created_by = $user->id;
 323         $page->updated_by = $user->id;
 324         $page->save();
 325
 326         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 327         $resp->assertSee('ExportWizardTheFifth');
 328
 329         $user->delete();
 330         $resp = $this->get($page->getUrl('/export/html'));
 331         $resp->assertStatus(200);
 332         $resp->assertDontSee('ExportWizardTheFifth');
 333     }
 334
 335     public function test_page_pdf_export_converts_iframes_to_links()
 336     {
 337         $page = Page::query()->first()->forceFill([
 338             'html'     => '<iframe width="560" height="315" src="//www.youtube.com/embed/ShqUjt33uOs"></iframe>',
 339         ]);
 340         $page->save();
 341
 342         $pdfHtml = '';
 343         $mockPdfGenerator = $this->mock(PdfGenerator::class);
 344         $mockPdfGenerator->shouldReceive('fromHtml')
 345             ->with(\Mockery::capture($pdfHtml))
 346             ->andReturn('');
 347         $mockPdfGenerator->shouldReceive('getActiveEngine')->andReturn(PdfGenerator::ENGINE_DOMPDF);
 348
 349         $this->asEditor()->get($page->getUrl('/export/pdf'));
 350         $this->assertStringNotContainsString('iframe>', $pdfHtml);
 351         $this->assertStringContainsString('<p><a href="https://www.youtube.com/embed/ShqUjt33uOs">https://www.youtube.com/embed/ShqUjt33uOs</a></p>', $pdfHtml);
 352     }
 353
 354     public function test_page_pdf_export_opens_details_blocks()
 355     {
 356         $page = $this->entities->page()->forceFill([
 357             'html'     => '<details><summary>Hello</summary><p>Content!</p></details>',
 358         ]);
 359         $page->save();
 360
 361         $pdfHtml = '';
 362         $mockPdfGenerator = $this->mock(PdfGenerator::class);
 363         $mockPdfGenerator->shouldReceive('fromHtml')
 364             ->with(\Mockery::capture($pdfHtml))
 365             ->andReturn('');
 366         $mockPdfGenerator->shouldReceive('getActiveEngine')->andReturn(PdfGenerator::ENGINE_DOMPDF);
 367
 368         $this->asEditor()->get($page->getUrl('/export/pdf'));
 369         $this->assertStringContainsString('<details open="open"', $pdfHtml);
 370     }
 371
 372     public function test_page_markdown_export()
 373     {
 374         $page = $this->entities->page();
 375
 376         $resp = $this->asEditor()->get($page->getUrl('/export/markdown'));
 377         $resp->assertStatus(200);
 378         $resp->assertSee($page->name);
 379         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.md"');
 380     }
 381
 382     public function test_page_markdown_export_uses_existing_markdown_if_apparent()
 383     {
 384         $page = $this->entities->page()->forceFill([
 385             'markdown' => '# A header',
 386             'html'     => '<h1>Dogcat</h1>',
 387         ]);
 388         $page->save();
 389
 390         $resp = $this->asEditor()->get($page->getUrl('/export/markdown'));
 391         $resp->assertSee('A header');
 392         $resp->assertDontSee('Dogcat');
 393     }
 394
 395     public function test_page_markdown_export_converts_html_where_no_markdown()
 396     {
 397         $page = $this->entities->page()->forceFill([
 398             'markdown' => '',
 399             'html'     => '<h1>Dogcat</h1><p>Some <strong>bold</strong> text</p>',
 400         ]);
 401         $page->save();
 402
 403         $resp = $this->asEditor()->get($page->getUrl('/export/markdown'));
 404         $resp->assertSee("# Dogcat\n\nSome **bold** text");
 405     }
 406
 407     public function test_chapter_markdown_export()
 408     {
 409         $chapter = $this->entities->chapter();
 410         $page = $chapter->pages()->first();
 411         $resp = $this->asEditor()->get($chapter->getUrl('/export/markdown'));
 412
 413         $resp->assertSee('# ' . $chapter->name);
 414         $resp->assertSee('# ' . $page->name);
 415     }
 416
 417     public function test_book_markdown_export()
 418     {
 419         $book = Book::query()->whereHas('pages')->whereHas('chapters')->first();
 420         $chapter = $book->chapters()->first();
 421         $page = $chapter->pages()->first();
 422         $resp = $this->asEditor()->get($book->getUrl('/export/markdown'));
 423
 424         $resp->assertSee('# ' . $book->name);
 425         $resp->assertSee('# ' . $chapter->name);
 426         $resp->assertSee('# ' . $page->name);
 427     }
 428
 429     public function test_book_markdown_export_concats_immediate_pages_with_newlines()
 430     {
 431         /** @var Book $book */
 432         $book = Book::query()->whereHas('pages')->first();
 433
 434         $this->asEditor()->get($book->getUrl('/create-page'));
 435         $this->get($book->getUrl('/create-page'));
 436
 437         [$pageA, $pageB] = $book->pages()->where('chapter_id', '=', 0)->get();
 438         $pageA->html = '<p>hello tester</p>';
 439         $pageA->save();
 440         $pageB->name = 'The second page in this test';
 441         $pageB->save();
 442
 443         $resp = $this->get($book->getUrl('/export/markdown'));
 444         $resp->assertDontSee('hello tester# The second page in this test');
 445         $resp->assertSee("hello tester\n\n# The second page in this test");
 446     }
 447
 448     public function test_export_option_only_visible_and_accessible_with_permission()
 449     {
 450         $book = Book::query()->whereHas('pages')->whereHas('chapters')->first();
 451         $chapter = $book->chapters()->first();
 452         $page = $chapter->pages()->first();
 453         $entities = [$book, $chapter, $page];
 454         $user = $this->users->viewer();
 455         $this->actingAs($user);
 456
 457         foreach ($entities as $entity) {
 458             $resp = $this->get($entity->getUrl());
 459             $resp->assertSee('/export/pdf');
 460         }
 461
 462         $this->permissions->removeUserRolePermissions($user, ['content-export']);
 463
 464         foreach ($entities as $entity) {
 465             $resp = $this->get($entity->getUrl());
 466             $resp->assertDontSee('/export/pdf');
 467             $resp = $this->get($entity->getUrl('/export/pdf'));
 468             $this->assertPermissionError($resp);
 469         }
 470     }
 471
 472     public function test_wkhtmltopdf_only_used_when_allow_untrusted_is_true()
 473     {
 474         $page = $this->entities->page();
 475
 476         config()->set('snappy.pdf.binary', '/abc123');
 477         config()->set('app.allow_untrusted_server_fetching', false);
 478
 479         $resp = $this->asEditor()->get($page->getUrl('/export/pdf'));
 480         $resp->assertStatus(200); // Sucessful response with invalid snappy binary indicates dompdf usage.
 481
 482         config()->set('app.allow_untrusted_server_fetching', true);
 483         $resp = $this->get($page->getUrl('/export/pdf'));
 484         $resp->assertStatus(500); // Bad response indicates wkhtml usage
 485     }
 486
 487     public function test_html_exports_contain_csp_meta_tag()
 488     {
 489         $entities = [
 490             $this->entities->page(),
 491             $this->entities->book(),
 492             $this->entities->chapter(),
 493         ];
 494
 495         foreach ($entities as $entity) {
 496             $resp = $this->asEditor()->get($entity->getUrl('/export/html'));
 497             $this->withHtml($resp)->assertElementExists('head meta[http-equiv="Content-Security-Policy"][content*="script-src "]');
 498         }
 499     }
 500
 501     public function test_html_exports_contain_body_classes_for_export_identification()
 502     {
 503         $page = $this->entities->page();
 504
 505         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 506         $this->withHtml($resp)->assertElementExists('body.export.export-format-html.export-engine-none');
 507     }
 508 }