BookStack Code Mirror - bookstack/blob - tests/Entity/ExportTest.php

   1 <?php
   2
   3 namespace Tests\Entity;
   4
   5 use BookStack\Entities\Models\Book;
   6 use BookStack\Entities\Models\Chapter;
   7 use BookStack\Entities\Models\Page;
   8 use BookStack\Entities\Tools\PdfGenerator;
   9 use BookStack\Exceptions\PdfExportException;
  10 use Illuminate\Support\Facades\Storage;
  11 use Tests\TestCase;
  12
  13 class ExportTest extends TestCase
  14 {
  15     public function test_page_text_export()
  16     {
  17         $page = $this->entities->page();
  18         $this->asEditor();
  19
  20         $resp = $this->get($page->getUrl('/export/plaintext'));
  21         $resp->assertStatus(200);
  22         $resp->assertSee($page->name);
  23         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.txt"');
  24     }
  25
  26     public function test_page_pdf_export()
  27     {
  28         $page = $this->entities->page();
  29         $this->asEditor();
  30
  31         $resp = $this->get($page->getUrl('/export/pdf'));
  32         $resp->assertStatus(200);
  33         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.pdf"');
  34     }
  35
  36     public function test_page_html_export()
  37     {
  38         $page = $this->entities->page();
  39         $this->asEditor();
  40
  41         $resp = $this->get($page->getUrl('/export/html'));
  42         $resp->assertStatus(200);
  43         $resp->assertSee($page->name);
  44         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.html"');
  45     }
  46
  47     public function test_book_text_export()
  48     {
  49         $book = $this->entities->bookHasChaptersAndPages();
  50         $directPage = $book->directPages()->first();
  51         $chapter = $book->chapters()->first();
  52         $chapterPage = $chapter->pages()->first();
  53         $this->entities->updatePage($directPage, ['html' => '<p>My awesome page</p>']);
  54         $this->entities->updatePage($chapterPage, ['html' => '<p>My little nested page</p>']);
  55         $this->asEditor();
  56
  57         $resp = $this->get($book->getUrl('/export/plaintext'));
  58         $resp->assertStatus(200);
  59         $resp->assertSee($book->name);
  60         $resp->assertSee($chapterPage->name);
  61         $resp->assertSee($chapter->name);
  62         $resp->assertSee($directPage->name);
  63         $resp->assertSee('My awesome page');
  64         $resp->assertSee('My little nested page');
  65         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $book->slug . '.txt"');
  66     }
  67
  68     public function test_book_text_export_format()
  69     {
  70         $entities = $this->entities->createChainBelongingToUser($this->users->viewer());
  71         $this->entities->updatePage($entities['page'], ['html' => '<p>My great page</p><p>Full of <strong>great</strong> stuff</p>', 'name' => 'My wonderful page!']);
  72         $entities['chapter']->name = 'Export chapter';
  73         $entities['chapter']->description = "A test chapter to be exported\nIt has loads of info within";
  74         $entities['book']->name = 'Export Book';
  75         $entities['book']->description = "This is a book with stuff to export";
  76         $entities['chapter']->save();
  77         $entities['book']->save();
  78
  79         $resp = $this->asEditor()->get($entities['book']->getUrl('/export/plaintext'));
  80
  81         $expected = "Export Book\nThis is a book with stuff to export\n\nExport chapter\nA test chapter to be exported\nIt has loads of info within\n\n";
  82         $expected .= "My wonderful page!\nMy great page Full of great stuff";
  83         $resp->assertSee($expected);
  84     }
  85
  86     public function test_book_pdf_export()
  87     {
  88         $page = $this->entities->page();
  89         $book = $page->book;
  90         $this->asEditor();
  91
  92         $resp = $this->get($book->getUrl('/export/pdf'));
  93         $resp->assertStatus(200);
  94         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $book->slug . '.pdf"');
  95     }
  96
  97     public function test_book_html_export()
  98     {
  99         $page = $this->entities->page();
 100         $book = $page->book;
 101         $this->asEditor();
 102
 103         $resp = $this->get($book->getUrl('/export/html'));
 104         $resp->assertStatus(200);
 105         $resp->assertSee($book->name);
 106         $resp->assertSee($page->name);
 107         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $book->slug . '.html"');
 108     }
 109
 110     public function test_book_html_export_shows_html_descriptions()
 111     {
 112         $book = $this->entities->bookHasChaptersAndPages();
 113         $chapter = $book->chapters()->first();
 114         $book->description_html = '<p>A description with <strong>HTML</strong> within!</p>';
 115         $chapter->description_html = '<p>A chapter description with <strong>HTML</strong> within!</p>';
 116         $book->save();
 117         $chapter->save();
 118
 119         $resp = $this->asEditor()->get($book->getUrl('/export/html'));
 120         $resp->assertSee($book->description_html, false);
 121         $resp->assertSee($chapter->description_html, false);
 122     }
 123
 124     public function test_chapter_text_export()
 125     {
 126         $chapter = $this->entities->chapter();
 127         $page = $chapter->pages[0];
 128         $this->entities->updatePage($page, ['html' => '<p>This is content within the page!</p>']);
 129         $this->asEditor();
 130
 131         $resp = $this->get($chapter->getUrl('/export/plaintext'));
 132         $resp->assertStatus(200);
 133         $resp->assertSee($chapter->name);
 134         $resp->assertSee($page->name);
 135         $resp->assertSee('This is content within the page!');
 136         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $chapter->slug . '.txt"');
 137     }
 138
 139     public function test_chapter_text_export_format()
 140     {
 141         $entities = $this->entities->createChainBelongingToUser($this->users->viewer());
 142         $this->entities->updatePage($entities['page'], ['html' => '<p>My great page</p><p>Full of <strong>great</strong> stuff</p>', 'name' => 'My wonderful page!']);
 143         $entities['chapter']->name = 'Export chapter';
 144         $entities['chapter']->description = "A test chapter to be exported\nIt has loads of info within";
 145         $entities['chapter']->save();
 146
 147         $resp = $this->asEditor()->get($entities['book']->getUrl('/export/plaintext'));
 148
 149         $expected = "Export chapter\nA test chapter to be exported\nIt has loads of info within\n\n";
 150         $expected .= "My wonderful page!\nMy great page Full of great stuff";
 151         $resp->assertSee($expected);
 152     }
 153
 154     public function test_chapter_pdf_export()
 155     {
 156         $chapter = $this->entities->chapter();
 157         $this->asEditor();
 158
 159         $resp = $this->get($chapter->getUrl('/export/pdf'));
 160         $resp->assertStatus(200);
 161         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $chapter->slug . '.pdf"');
 162     }
 163
 164     public function test_chapter_html_export()
 165     {
 166         $chapter = $this->entities->chapter();
 167         $page = $chapter->pages[0];
 168         $this->asEditor();
 169
 170         $resp = $this->get($chapter->getUrl('/export/html'));
 171         $resp->assertStatus(200);
 172         $resp->assertSee($chapter->name);
 173         $resp->assertSee($page->name);
 174         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $chapter->slug . '.html"');
 175     }
 176
 177     public function test_chapter_html_export_shows_html_descriptions()
 178     {
 179         $chapter = $this->entities->chapter();
 180         $chapter->description_html = '<p>A description with <strong>HTML</strong> within!</p>';
 181         $chapter->save();
 182
 183         $resp = $this->asEditor()->get($chapter->getUrl('/export/html'));
 184         $resp->assertSee($chapter->description_html, false);
 185     }
 186
 187     public function test_page_html_export_contains_custom_head_if_set()
 188     {
 189         $page = $this->entities->page();
 190
 191         $customHeadContent = '<style>p{color: red;}</style>';
 192         $this->setSettings(['app-custom-head' => $customHeadContent]);
 193
 194         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 195         $resp->assertSee($customHeadContent, false);
 196     }
 197
 198     public function test_page_html_export_does_not_break_with_only_comments_in_custom_head()
 199     {
 200         $page = $this->entities->page();
 201
 202         $customHeadContent = '<!-- A comment -->';
 203         $this->setSettings(['app-custom-head' => $customHeadContent]);
 204
 205         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 206         $resp->assertStatus(200);
 207         $resp->assertSee($customHeadContent, false);
 208     }
 209
 210     public function test_page_html_export_use_absolute_dates()
 211     {
 212         $page = $this->entities->page();
 213
 214         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 215         $resp->assertSee($page->created_at->isoFormat('D MMMM Y HH:mm:ss'));
 216         $resp->assertDontSee($page->created_at->diffForHumans());
 217         $resp->assertSee($page->updated_at->isoFormat('D MMMM Y HH:mm:ss'));
 218         $resp->assertDontSee($page->updated_at->diffForHumans());
 219     }
 220
 221     public function test_page_export_does_not_include_user_or_revision_links()
 222     {
 223         $page = $this->entities->page();
 224
 225         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 226         $resp->assertDontSee($page->getUrl('/revisions'));
 227         $resp->assertDontSee($page->createdBy->getProfileUrl());
 228         $resp->assertSee($page->createdBy->name);
 229     }
 230
 231     public function test_page_export_sets_right_data_type_for_svg_embeds()
 232     {
 233         $page = $this->entities->page();
 234         Storage::disk('local')->makeDirectory('uploads/images/gallery');
 235         Storage::disk('local')->put('uploads/images/gallery/svg_test.svg', '<svg></svg>');
 236         $page->html = '<img src="http://localhost/uploads/images/gallery/svg_test.svg">';
 237         $page->save();
 238
 239         $this->asEditor();
 240         $resp = $this->get($page->getUrl('/export/html'));
 241         Storage::disk('local')->delete('uploads/images/gallery/svg_test.svg');
 242
 243         $resp->assertStatus(200);
 244         $resp->assertSee('<img src="data:image/svg+xml;base64', false);
 245     }
 246
 247     public function test_page_image_containment_works_on_multiple_images_within_a_single_line()
 248     {
 249         $page = $this->entities->page();
 250         Storage::disk('local')->makeDirectory('uploads/images/gallery');
 251         Storage::disk('local')->put('uploads/images/gallery/svg_test.svg', '<svg></svg>');
 252         Storage::disk('local')->put('uploads/images/gallery/svg_test2.svg', '<svg></svg>');
 253         $page->html = '<img src="http://localhost/uploads/images/gallery/svg_test.svg" class="a"><img src="http://localhost/uploads/images/gallery/svg_test2.svg" class="b">';
 254         $page->save();
 255
 256         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 257         Storage::disk('local')->delete('uploads/images/gallery/svg_test.svg');
 258         Storage::disk('local')->delete('uploads/images/gallery/svg_test2.svg');
 259
 260         $resp->assertDontSee('http://localhost/uploads/images/gallery/svg_test');
 261     }
 262
 263     public function test_page_export_contained_html_image_fetches_only_run_when_url_points_to_image_upload_folder()
 264     {
 265         $page = $this->entities->page();
 266         $page->html = '<img src="http://localhost/uploads/images/gallery/svg_test.svg"/>'
 267             . '<img src="http://localhost/uploads/svg_test.svg"/>'
 268             . '<img src="/uploads/svg_test.svg"/>';
 269         $storageDisk = Storage::disk('local');
 270         $storageDisk->makeDirectory('uploads/images/gallery');
 271         $storageDisk->put('uploads/images/gallery/svg_test.svg', '<svg>good</svg>');
 272         $storageDisk->put('uploads/svg_test.svg', '<svg>bad</svg>');
 273         $page->save();
 274
 275         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 276
 277         $storageDisk->delete('uploads/images/gallery/svg_test.svg');
 278         $storageDisk->delete('uploads/svg_test.svg');
 279
 280         $resp->assertDontSee('http://localhost/uploads/images/gallery/svg_test.svg', false);
 281         $resp->assertSee('http://localhost/uploads/svg_test.svg');
 282         $resp->assertSee('src="/uploads/svg_test.svg"', false);
 283     }
 284
 285     public function test_page_export_contained_html_does_not_allow_upward_traversal_with_local()
 286     {
 287         $contents = file_get_contents(public_path('.htaccess'));
 288         config()->set('filesystems.images', 'local');
 289
 290         $page = $this->entities->page();
 291         $page->html = '<img src="http://localhost/uploads/images/../../.htaccess"/>';
 292         $page->save();
 293
 294         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 295         $resp->assertDontSee(base64_encode($contents));
 296     }
 297
 298     public function test_page_export_contained_html_does_not_allow_upward_traversal_with_local_secure()
 299     {
 300         $testFilePath = storage_path('logs/test.txt');
 301         config()->set('filesystems.images', 'local_secure');
 302         file_put_contents($testFilePath, 'I am a cat');
 303
 304         $page = $this->entities->page();
 305         $page->html = '<img src="http://localhost/uploads/images/../../logs/test.txt"/>';
 306         $page->save();
 307
 308         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 309         $resp->assertDontSee(base64_encode('I am a cat'));
 310         unlink($testFilePath);
 311     }
 312
 313     public function test_exports_removes_scripts_from_custom_head()
 314     {
 315         $entities = [
 316             Page::query()->first(), Chapter::query()->first(), Book::query()->first(),
 317         ];
 318         setting()->put('app-custom-head', '<script>window.donkey = "cat";</script><style>.my-test-class { color: red; }</style>');
 319
 320         foreach ($entities as $entity) {
 321             $resp = $this->asEditor()->get($entity->getUrl('/export/html'));
 322             $resp->assertDontSee('window.donkey');
 323             $resp->assertDontSee('<script', false);
 324             $resp->assertSee('.my-test-class { color: red; }');
 325         }
 326     }
 327
 328     public function test_page_export_with_deleted_creator_and_updater()
 329     {
 330         $user = $this->users->viewer(['name' => 'ExportWizardTheFifth']);
 331         $page = $this->entities->page();
 332         $page->created_by = $user->id;
 333         $page->updated_by = $user->id;
 334         $page->save();
 335
 336         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 337         $resp->assertSee('ExportWizardTheFifth');
 338
 339         $user->delete();
 340         $resp = $this->get($page->getUrl('/export/html'));
 341         $resp->assertStatus(200);
 342         $resp->assertDontSee('ExportWizardTheFifth');
 343     }
 344
 345     public function test_page_pdf_export_converts_iframes_to_links()
 346     {
 347         $page = Page::query()->first()->forceFill([
 348             'html'     => '<iframe width="560" height="315" src="//www.youtube.com/embed/ShqUjt33uOs"></iframe>',
 349         ]);
 350         $page->save();
 351
 352         $pdfHtml = '';
 353         $mockPdfGenerator = $this->mock(PdfGenerator::class);
 354         $mockPdfGenerator->shouldReceive('fromHtml')
 355             ->with(\Mockery::capture($pdfHtml))
 356             ->andReturn('');
 357         $mockPdfGenerator->shouldReceive('getActiveEngine')->andReturn(PdfGenerator::ENGINE_DOMPDF);
 358
 359         $this->asEditor()->get($page->getUrl('/export/pdf'));
 360         $this->assertStringNotContainsString('iframe>', $pdfHtml);
 361         $this->assertStringContainsString('<p><a href="https://www.youtube.com/embed/ShqUjt33uOs">https://www.youtube.com/embed/ShqUjt33uOs</a></p>', $pdfHtml);
 362     }
 363
 364     public function test_page_pdf_export_opens_details_blocks()
 365     {
 366         $page = $this->entities->page()->forceFill([
 367             'html'     => '<details><summary>Hello</summary><p>Content!</p></details>',
 368         ]);
 369         $page->save();
 370
 371         $pdfHtml = '';
 372         $mockPdfGenerator = $this->mock(PdfGenerator::class);
 373         $mockPdfGenerator->shouldReceive('fromHtml')
 374             ->with(\Mockery::capture($pdfHtml))
 375             ->andReturn('');
 376         $mockPdfGenerator->shouldReceive('getActiveEngine')->andReturn(PdfGenerator::ENGINE_DOMPDF);
 377
 378         $this->asEditor()->get($page->getUrl('/export/pdf'));
 379         $this->assertStringContainsString('<details open="open"', $pdfHtml);
 380     }
 381
 382     public function test_page_markdown_export()
 383     {
 384         $page = $this->entities->page();
 385
 386         $resp = $this->asEditor()->get($page->getUrl('/export/markdown'));
 387         $resp->assertStatus(200);
 388         $resp->assertSee($page->name);
 389         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.md"');
 390     }
 391
 392     public function test_page_markdown_export_uses_existing_markdown_if_apparent()
 393     {
 394         $page = $this->entities->page()->forceFill([
 395             'markdown' => '# A header',
 396             'html'     => '<h1>Dogcat</h1>',
 397         ]);
 398         $page->save();
 399
 400         $resp = $this->asEditor()->get($page->getUrl('/export/markdown'));
 401         $resp->assertSee('A header');
 402         $resp->assertDontSee('Dogcat');
 403     }
 404
 405     public function test_page_markdown_export_converts_html_where_no_markdown()
 406     {
 407         $page = $this->entities->page()->forceFill([
 408             'markdown' => '',
 409             'html'     => '<h1>Dogcat</h1><p>Some <strong>bold</strong> text</p>',
 410         ]);
 411         $page->save();
 412
 413         $resp = $this->asEditor()->get($page->getUrl('/export/markdown'));
 414         $resp->assertSee("# Dogcat\n\nSome **bold** text");
 415     }
 416
 417     public function test_chapter_markdown_export()
 418     {
 419         $chapter = $this->entities->chapter();
 420         $page = $chapter->pages()->first();
 421         $resp = $this->asEditor()->get($chapter->getUrl('/export/markdown'));
 422
 423         $resp->assertSee('# ' . $chapter->name);
 424         $resp->assertSee('# ' . $page->name);
 425     }
 426
 427     public function test_book_markdown_export()
 428     {
 429         $book = Book::query()->whereHas('pages')->whereHas('chapters')->first();
 430         $chapter = $book->chapters()->first();
 431         $page = $chapter->pages()->first();
 432         $resp = $this->asEditor()->get($book->getUrl('/export/markdown'));
 433
 434         $resp->assertSee('# ' . $book->name);
 435         $resp->assertSee('# ' . $chapter->name);
 436         $resp->assertSee('# ' . $page->name);
 437     }
 438
 439     public function test_book_markdown_export_concats_immediate_pages_with_newlines()
 440     {
 441         /** @var Book $book */
 442         $book = Book::query()->whereHas('pages')->first();
 443
 444         $this->asEditor()->get($book->getUrl('/create-page'));
 445         $this->get($book->getUrl('/create-page'));
 446
 447         [$pageA, $pageB] = $book->pages()->where('chapter_id', '=', 0)->get();
 448         $pageA->html = '<p>hello tester</p>';
 449         $pageA->save();
 450         $pageB->name = 'The second page in this test';
 451         $pageB->save();
 452
 453         $resp = $this->get($book->getUrl('/export/markdown'));
 454         $resp->assertDontSee('hello tester# The second page in this test');
 455         $resp->assertSee("hello tester\n\n# The second page in this test");
 456     }
 457
 458     public function test_export_option_only_visible_and_accessible_with_permission()
 459     {
 460         $book = Book::query()->whereHas('pages')->whereHas('chapters')->first();
 461         $chapter = $book->chapters()->first();
 462         $page = $chapter->pages()->first();
 463         $entities = [$book, $chapter, $page];
 464         $user = $this->users->viewer();
 465         $this->actingAs($user);
 466
 467         foreach ($entities as $entity) {
 468             $resp = $this->get($entity->getUrl());
 469             $resp->assertSee('/export/pdf');
 470         }
 471
 472         $this->permissions->removeUserRolePermissions($user, ['content-export']);
 473
 474         foreach ($entities as $entity) {
 475             $resp = $this->get($entity->getUrl());
 476             $resp->assertDontSee('/export/pdf');
 477             $resp = $this->get($entity->getUrl('/export/pdf'));
 478             $this->assertPermissionError($resp);
 479         }
 480     }
 481
 482     public function test_wkhtmltopdf_only_used_when_allow_untrusted_is_true()
 483     {
 484         $page = $this->entities->page();
 485
 486         config()->set('exports.snappy.pdf_binary', '/abc123');
 487         config()->set('app.allow_untrusted_server_fetching', false);
 488
 489         $resp = $this->asEditor()->get($page->getUrl('/export/pdf'));
 490         $resp->assertStatus(200); // Sucessful response with invalid snappy binary indicates dompdf usage.
 491
 492         config()->set('app.allow_untrusted_server_fetching', true);
 493         $resp = $this->get($page->getUrl('/export/pdf'));
 494         $resp->assertStatus(500); // Bad response indicates wkhtml usage
 495     }
 496
 497     public function test_pdf_command_option_used_if_set()
 498     {
 499         $page = $this->entities->page();
 500         $command = 'cp {input_html_path} {output_pdf_path}';
 501         config()->set('exports.pdf_command', $command);
 502
 503         $resp = $this->asEditor()->get($page->getUrl('/export/pdf'));
 504         $download = $resp->getContent();
 505
 506         $this->assertStringContainsString(e($page->name), $download);
 507         $this->assertStringContainsString('<html lang=', $download);
 508     }
 509
 510     public function test_pdf_command_option_errors_if_output_path_not_written_to()
 511     {
 512         $page = $this->entities->page();
 513         $command = 'echo "hi"';
 514         config()->set('exports.pdf_command', $command);
 515
 516         $this->assertThrows(function () use ($page) {
 517             $this->withoutExceptionHandling()->asEditor()->get($page->getUrl('/export/pdf'));
 518         }, PdfExportException::class);
 519     }
 520
 521     public function test_pdf_command_option_errors_if_command_returns_error_status()
 522     {
 523         $page = $this->entities->page();
 524         $command = 'exit 1';
 525         config()->set('exports.pdf_command', $command);
 526
 527         $this->assertThrows(function () use ($page) {
 528             $this->withoutExceptionHandling()->asEditor()->get($page->getUrl('/export/pdf'));
 529         }, PdfExportException::class);
 530     }
 531
 532     public function test_html_exports_contain_csp_meta_tag()
 533     {
 534         $entities = [
 535             $this->entities->page(),
 536             $this->entities->book(),
 537             $this->entities->chapter(),
 538         ];
 539
 540         foreach ($entities as $entity) {
 541             $resp = $this->asEditor()->get($entity->getUrl('/export/html'));
 542             $this->withHtml($resp)->assertElementExists('head meta[http-equiv="Content-Security-Policy"][content*="script-src "]');
 543         }
 544     }
 545
 546     public function test_html_exports_contain_body_classes_for_export_identification()
 547     {
 548         $page = $this->entities->page();
 549
 550         $resp = $this->asEditor()->get($page->getUrl('/export/html'));
 551         $this->withHtml($resp)->assertElementExists('body.export.export-format-html.export-engine-none');
 552     }
 553 }