X-Git-Url: http://source.bookstackapp.com/bookstack/blobdiff_plain/cc10d1ddfc652f6bcf3bbf61d5ec2e2861394c03..06901b878f2c8057a6f9b7d2e0adfda425c68dee:/tests/Entity/CommentTest.php diff --git a/tests/Entity/CommentTest.php b/tests/Entity/CommentTest.php index 23fc68197..76e014e80 100644 --- a/tests/Entity/CommentTest.php +++ b/tests/Entity/CommentTest.php @@ -27,7 +27,7 @@ class CommentTest extends TestCase 'local_id' => 1, 'entity_id' => $page->id, 'entity_type' => Page::newModelInstance()->getMorphClass(), - 'text' => $comment->text, + 'text' => null, 'parent_id' => 2, ]); @@ -43,17 +43,17 @@ class CommentTest extends TestCase $this->postJson("/comment/$page->id", $comment->getAttributes()); $comment = $page->comments()->first(); - $newText = 'updated text content'; + $newHtml = '
updated text content
'; $resp = $this->putJson("/comment/$comment->id", [ - 'text' => $newText, + 'html' => $newHtml, ]); $resp->assertStatus(200); - $resp->assertSee($newText); - $resp->assertDontSee($comment->text); + $resp->assertSee($newHtml, false); + $resp->assertDontSee($comment->html, false); $this->assertDatabaseHas('comments', [ - 'text' => $newText, + 'html' => $newHtml, 'entity_id' => $page->id, ]); @@ -80,46 +80,41 @@ class CommentTest extends TestCase $this->assertActivityExists(ActivityType::COMMENT_DELETE); } - public function test_comments_converts_markdown_input_to_html() + public function test_scripts_cannot_be_injected_via_comment_html() { $page = $this->entities->page(); - $this->asAdmin()->postJson("/comment/$page->id", [ - 'text' => '# My Title', - ]); - - $this->assertDatabaseHas('comments', [ - 'entity_id' => $page->id, - 'entity_type' => $page->getMorphClass(), - 'text' => '# My Title', - 'html' => "My lovely comment
'; + $this->asAdmin()->postJson("/comment/$page->id", [ + 'html' => $script, ]); $pageView = $this->get($page->getUrl()); $pageView->assertDontSee($script, false); - $pageView->assertSee('sometextinthecomment'); + $pageView->assertSee('My lovely comment
', false); $comment = $page->comments()->first(); $this->putJson("/comment/$comment->id", [ - 'text' => $script . 'updated', + 'html' => $script . 'updated
', ]); $pageView = $this->get($page->getUrl()); $pageView->assertDontSee($script, false); - $pageView->assertSee('sometextinthecommentupdated'); + $pageView->assertSee('My lovely comment
updated
'); + } + + public function test_scripts_are_removed_even_if_already_in_db() + { + $page = $this->entities->page(); + Comment::factory()->create([ + 'html' => 'scriptincommentest
', + 'entity_type' => 'page', 'entity_id' => $page + ]); + + $resp = $this->asAdmin()->get($page->getUrl()); + $resp->assertSee('scriptincommentest', false); + $resp->assertDontSee('superbadscript', false); + $resp->assertDontSee('superbadonclick', false); } public function test_reply_comments_are_nested() @@ -127,15 +122,17 @@ class CommentTest extends TestCase $this->asAdmin(); $page = $this->entities->page(); - $this->postJson("/comment/$page->id", ['text' => 'My new comment']); - $this->postJson("/comment/$page->id", ['text' => 'My new comment']); + $this->postJson("/comment/$page->id", ['html' => 'My new comment
']); + $this->postJson("/comment/$page->id", ['html' => 'My new comment
']); $respHtml = $this->withHtml($this->get($page->getUrl())); $respHtml->assertElementCount('.comment-branch', 3); $respHtml->assertElementNotExists('.comment-branch .comment-branch'); $comment = $page->comments()->first(); - $resp = $this->postJson("/comment/$page->id", ['text' => 'My nested comment', 'parent_id' => $comment->local_id]); + $resp = $this->postJson("/comment/$page->id", [ + 'html' => 'My nested comment
', 'parent_id' => $comment->local_id + ]); $resp->assertStatus(200); $respHtml = $this->withHtml($this->get($page->getUrl())); @@ -147,7 +144,7 @@ class CommentTest extends TestCase { $page = $this->entities->page(); - $this->asAdmin()->postJson("/comment/$page->id", ['text' => 'My great comment to see in the editor']); + $this->asAdmin()->postJson("/comment/$page->id", ['html' => 'My great comment to see in the editor
']); $respHtml = $this->withHtml($this->get($page->getUrl('/edit'))); $respHtml->assertElementContains('.comment-box .content', 'My great comment to see in the editor'); @@ -164,4 +161,34 @@ class CommentTest extends TestCase $pageResp = $this->asAdmin()->get($page->getUrl()); $pageResp->assertSee('Wolfeschlegelsâ¦'); } + + public function test_comment_editor_js_loaded_with_create_or_edit_permissions() + { + $editor = $this->users->editor(); + $page = $this->entities->page(); + + $resp = $this->actingAs($editor)->get($page->getUrl()); + $resp->assertSee('tinymce.min.js?', false); + $resp->assertSee('window.editor_translations', false); + $resp->assertSee('component="entity-selector"', false); + + $this->permissions->removeUserRolePermissions($editor, ['comment-create-all']); + $this->permissions->grantUserRolePermissions($editor, ['comment-update-own']); + + $resp = $this->actingAs($editor)->get($page->getUrl()); + $resp->assertDontSee('tinymce.min.js?', false); + $resp->assertDontSee('window.editor_translations', false); + $resp->assertDontSee('component="entity-selector"', false); + + Comment::factory()->create([ + 'created_by' => $editor->id, + 'entity_type' => 'page', + 'entity_id' => $page->id, + ]); + + $resp = $this->actingAs($editor)->get($page->getUrl()); + $resp->assertSee('tinymce.min.js?', false); + $resp->assertSee('window.editor_translations', false); + $resp->assertSee('component="entity-selector"', false); + } }