webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-07-30 04:23:11 +03:00
Code Activity

Prevent dbl exts. on img upload, Randomized attachment upload names

Browse Source
This commit is contained in:
Dan Brown
2019-03-24 19:07:18 +00:00
parent f5fe524e6c
commit 193e2ffebe
6 changed files with 48 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
tests/Uploads/AttachmentTest.php
View File

@ -28,16 +28,6 @@ class AttachmentTest extends TestCase
return $this->call('POST', '/attachments/upload', ['uploaded_to' => $uploadedTo], [], ['file' => $file], []);
}
/**
* Get the expected upload path for a file.
* @param $fileName
* @return string
*/
protected function getUploadPath($fileName)
{
return 'uploads/files/' . Date('Y-m-M') . '/' . $fileName;
}
/**
* Delete all uploaded files.
* To assist with cleanup.
@ -64,17 +54,34 @@ class AttachmentTest extends TestCase
'order' => 1,
'created_by' => $admin->id,
'updated_by' => $admin->id,
'path' => $this->getUploadPath($fileName)
];
$upload = $this->uploadFile($fileName, $page->id);
$upload->assertStatus(200);
$attachment = Attachment::query()->orderBy('id', 'desc')->first();
$expectedResp['path'] = $attachment->path;
$upload->assertJson($expectedResp);
$this->assertDatabaseHas('attachments', $expectedResp);
$this->deleteUploads();
}
public function test_file_upload_does_not_use_filename()
{
$page = Page::first();
$fileName = 'upload_test_file.txt';
$upload = $this->asAdmin()->uploadFile($fileName, $page->id);
$upload->assertStatus(200);
$attachment = Attachment::query()->orderBy('id', 'desc')->first();
$this->assertNotContains($fileName, $attachment->path);
$this->assertStringEndsWith('.txt', $attachment->path);
}
public function test_file_display_and_access()
{
$page = Page::first();
@ -172,7 +179,8 @@ class AttachmentTest extends TestCase
$fileName = 'deletion_test.txt';
$this->uploadFile($fileName, $page->id);
$filePath = base_path('storage/' . $this->getUploadPath($fileName));
$attachment = Attachment::query()->orderBy('id', 'desc')->first();
$filePath = storage_path($attachment->path);
$this->assertTrue(file_exists($filePath), 'File at path ' . $filePath . ' does not exist');
$attachment = \BookStack\Uploads\Attachment::first();
@ -193,7 +201,8 @@ class AttachmentTest extends TestCase
$fileName = 'deletion_test.txt';
$this->uploadFile($fileName, $page->id);
$filePath = base_path('storage/' . $this->getUploadPath($fileName));
$attachment = Attachment::query()->orderBy('id', 'desc')->first();
$filePath = storage_path($attachment->path);
$this->assertTrue(file_exists($filePath), 'File at path ' . $filePath . ' does not exist');
$this->assertDatabaseHas('attachments', [