View source
<?php
namespace Drupal\Tests\file\Functional;
use Drupal\Component\Render\FormattableMarkup;
use Drupal\Core\File\FileSystemInterface;
use Drupal\Core\Url;
use Drupal\file\Entity\File;
use Drupal\Tests\TestFileCreationTrait;
class SaveUploadTest extends FileManagedTestBase {
use TestFileCreationTrait {
getTestFiles as drupalGetTestFiles;
}
public static $modules = [
'dblog',
];
protected $defaultTheme = 'stark';
protected $image;
protected $phpfile;
protected $maxFidBefore;
protected $imageExtension;
protected function setUp() {
parent::setUp();
$account = $this
->drupalCreateUser([
'access site reports',
]);
$this
->drupalLogin($account);
$image_files = $this
->drupalGetTestFiles('image');
$this->image = File::create((array) current($image_files));
list(, $this->imageExtension) = explode('.', $this->image
->getFilename());
$this
->assertFileExists($this->image
->getFileUri());
$this->phpfile = current($this
->drupalGetTestFiles('php'));
$this
->assertFileExists($this->phpfile->uri);
$this->maxFidBefore = (int) \Drupal::entityQueryAggregate('file')
->aggregate('fid', 'max')
->execute()[0]['fid_max'];
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
];
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertRaw(t('You WIN!'), 'Found the success message.');
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
file_test_reset();
}
public function testNormal() {
$max_fid_after = (int) \Drupal::entityQueryAggregate('file')
->aggregate('fid', 'max')
->execute()[0]['fid_max'];
$this
->assertTrue($max_fid_after > $this->maxFidBefore, 'A new file was created.');
$file1 = File::load($max_fid_after);
$this
->assertInstanceOf(File::class, $file1);
$this
->assertEqual(substr($file1
->getMimeType(), 0, 5), 'image', 'A MIME type was set.');
file_test_reset();
$image2 = current($this
->drupalGetTestFiles('image'));
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($image2->uri),
];
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertRaw(t('You WIN!'));
$max_fid_after = (int) \Drupal::entityQueryAggregate('file')
->aggregate('fid', 'max')
->execute()[0]['fid_max'];
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
$file2 = File::load($max_fid_after);
$this
->assertInstanceOf(File::class, $file2);
$this
->assertEqual(substr($file2
->getMimeType(), 0, 5), 'image', 'A MIME type was set.');
$files = File::loadMultiple([
$file1
->id(),
$file2
->id(),
]);
$this
->assertTrue(isset($files[$file1
->id()]), 'File was loaded successfully');
$this
->assertTrue(isset($files[$file2
->id()]), 'File was loaded successfully');
$image3 = current($this
->drupalGetTestFiles('image'));
$image3_realpath = \Drupal::service('file_system')
->realpath($image3->uri);
$dir = $this
->randomMachineName();
$edit = [
'files[file_test_upload]' => $image3_realpath,
'file_subdir' => $dir,
];
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertRaw(t('You WIN!'));
$this
->assertFileExists('temporary://' . $dir . '/' . trim(\Drupal::service('file_system')
->basename($image3_realpath)));
}
public function testDuplicate() {
$image1 = current($this
->drupalGetTestFiles('image'));
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($image1->uri),
];
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$max_fid_after = (int) \Drupal::entityQueryAggregate('file')
->aggregate('fid', 'max')
->execute()[0]['fid_max'];
$file1 = File::load($max_fid_after);
unlink(\Drupal::service('file_system')
->realpath($file1
->getFileUri()));
$image2 = $image1;
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($image2->uri),
];
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$message = t('The file %file already exists. Enter a unique file URI.', [
'%file' => $file1
->getFileUri(),
]);
$this
->assertRaw($message);
$max_fid_before_duplicate = $max_fid_after;
$max_fid_after = (int) \Drupal::entityQueryAggregate('file')
->aggregate('fid', 'max')
->execute()[0]['fid_max'];
$this
->assertEqual($max_fid_before_duplicate, $max_fid_after, 'A new managed file was not created.');
}
public function testHandleExtension() {
$extensions = 'foo';
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
'extensions' => $extensions,
];
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$message = t('Only files with the following extensions are allowed:') . ' <em class="placeholder">' . $extensions . '</em>';
$this
->assertRaw($message, 'Cannot upload a disallowed extension');
$this
->assertRaw(t('Epic upload FAIL!'), 'Found the failure message.');
$this
->assertFileHooksCalled([
'validate',
]);
file_test_reset();
$extensions = 'foo ' . $this->imageExtension;
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
'extensions' => $extensions,
];
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertNoRaw(t('Only files with the following extensions are allowed:'), 'Can upload an allowed extension.');
$this
->assertRaw(t('You WIN!'), 'Found the success message.');
$this
->assertFileHooksCalled([
'validate',
'load',
'update',
]);
file_test_reset();
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
'allow_all_extensions' => 'empty_array',
];
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertNoRaw(t('Only files with the following extensions are allowed:'), 'Can upload any extension.');
$this
->assertRaw(t('You WIN!'), 'Found the success message.');
$this
->assertFileHooksCalled([
'validate',
'load',
'update',
]);
file_test_reset();
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->phpfile->uri),
'allow_all_extensions' => 'empty_array',
'is_image_file' => FALSE,
];
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$message = t('For security reasons, your upload has been renamed to') . ' <em class="placeholder">' . $this->phpfile->filename . '_.txt' . '</em>';
$this
->assertRaw($message, 'Dangerous file was renamed.');
$this
->assertSession()
->pageTextContains('File name is php-2.php_.txt.');
$this
->assertRaw(t('File MIME type is text/plain.'), "Dangerous file's MIME type was changed.");
$this
->assertRaw(t('You WIN!'), 'Found the success message.');
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
}
public function testHandleDangerousFile() {
$config = $this
->config('system.file');
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->phpfile->uri),
'is_image_file' => FALSE,
'extensions' => 'php',
];
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$message = t('For security reasons, your upload has been renamed to') . ' <em class="placeholder">' . $this->phpfile->filename . '_.txt' . '</em>';
$this
->assertRaw($message, 'Dangerous file was renamed.');
$this
->assertSession()
->pageTextContains('File name is php-2.php_.txt.');
$this
->assertRaw(t('File MIME type is text/plain.'), "Dangerous file's MIME type was changed.");
$this
->assertRaw(t('You WIN!'), 'Found the success message.');
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
$config
->set('allow_insecure_uploads', 1)
->save();
file_test_reset();
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertNoRaw(t('For security reasons, your upload has been renamed'), 'Found no security message.');
$this
->assertSession()
->pageTextContains('File name is php-2.php.');
$this
->assertRaw(t('You WIN!'), 'Found the success message.');
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
file_test_reset();
$edit['extensions'] = 'foo';
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$message = t('Only files with the following extensions are allowed:') . ' <em class="placeholder">' . $edit['extensions'] . '</em>';
$this
->assertRaw($message, 'Cannot upload a disallowed extension');
$this
->assertRaw(t('Epic upload FAIL!'), 'Found the failure message.');
$this
->assertFileHooksCalled([
'validate',
]);
file_test_reset();
$config
->set('allow_insecure_uploads', 0)
->save();
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$message = t('Only files with the following extensions are allowed:') . ' <em class="placeholder">' . $edit['extensions'] . '</em>';
$this
->assertRaw($message, 'Cannot upload a disallowed extension');
$this
->assertRaw(t('Epic upload FAIL!'), 'Found the failure message.');
$this
->assertFileHooksCalled([
'validate',
]);
file_test_reset();
}
public function testHandleFileMunge() {
$this
->config('system.file')
->set('allow_insecure_uploads', 0)
->save();
$original_image_uri = $this->image
->getFileUri();
$this->image = file_move($this->image, $original_image_uri . '.foo.' . $this->imageExtension);
file_test_reset();
$extensions = $this->imageExtension;
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
'extensions' => $extensions,
];
$munged_filename = $this->image
->getFilename();
$munged_filename = substr($munged_filename, 0, strrpos($munged_filename, '.'));
$munged_filename .= '_.' . $this->imageExtension;
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertRaw(t('For security reasons, your upload has been renamed'), 'Found security message.');
$this
->assertRaw(t('File name is @filename', [
'@filename' => $munged_filename,
]), 'File was successfully munged.');
$this
->assertRaw(t('You WIN!'), 'Found the success message.');
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
file_test_reset();
$extensions = 'foo ' . $this->imageExtension;
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
'extensions' => $extensions,
];
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertNoRaw(t('For security reasons, your upload has been renamed'), 'Found no security message.');
$this
->assertRaw(t('File name is @filename', [
'@filename' => $this->image
->getFilename(),
]), 'File was not munged when all extensions within it are allowed.');
$this
->assertRaw(t('You WIN!'), 'Found the success message.');
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
$this->image = file_move($this->image, $original_image_uri . '.foo.txt.' . $this->imageExtension);
file_test_reset();
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
'allow_all_extensions' => 'empty_array',
];
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertNoRaw(t('For security reasons, your upload has been renamed'), 'Found no security message.');
$this
->assertRaw(t('File name is @filename', [
'@filename' => $this->image
->getFilename(),
]), 'File was not munged when allowing any extension.');
$this
->assertRaw(t('You WIN!'), 'Found the success message.');
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
$this->image = file_move($this->image, $original_image_uri . '.php.' . $this->imageExtension);
file_test_reset();
$extensions = 'php ' . $this->imageExtension;
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
'extensions' => $extensions,
];
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertRaw(t('For security reasons, your upload has been renamed'), 'Found security message.');
$this
->assertRaw(t('File name is @filename', [
'@filename' => 'image-test.png.php_.png',
]), 'File was successfully munged.');
$this
->assertRaw(t('You WIN!'), 'Found the success message.');
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
file_test_reset();
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
'allow_all_extensions' => 'empty_array',
];
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertRaw(t('For security reasons, your upload has been renamed'), 'Found security message.');
$this
->assertRaw(t('File name is @filename.', [
'@filename' => 'image-test.png_.php_.png_.txt',
]), 'File was successfully munged.');
$this
->assertRaw(t('You WIN!'), 'Found the success message.');
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
$this->image = file_move($this->image, $original_image_uri . '.cgi.' . $this->imageExtension . '.txt');
file_test_reset();
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
'allow_all_extensions' => 'empty_array',
];
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertRaw(t('For security reasons, your upload has been renamed'), 'Found security message.');
$this
->assertRaw(t('File name is @filename.', [
'@filename' => 'image-test.png_.cgi_.png_.txt',
]), 'File was successfully munged.');
$this
->assertRaw(t('You WIN!'), 'Found the success message.');
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
file_test_reset();
$edit = [
'files[file_test_upload][]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
'allow_all_extensions' => 'empty_string',
];
$this
->drupalPostForm('file-test/save_upload_from_form_test', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertNoRaw(t('For security reasons, your upload has been renamed'), 'Found security message.');
$this
->assertRaw(t('Epic upload FAIL!'), 'Found the failure message.');
$this
->assertFileHooksCalled([
'validate',
]);
}
public function testExistingRename() {
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_RENAME,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
];
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertRaw(t('You WIN!'), 'Found the success message.');
$this
->assertSession()
->pageTextContains('File name is image-test_0.png.');
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
}
public function testExistingReplace() {
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
];
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertRaw(t('You WIN!'), 'Found the success message.');
$this
->assertSession()
->pageTextContains('File name is image-test.png.');
$this
->assertFileHooksCalled([
'validate',
'load',
'update',
]);
}
public function testExistingError() {
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_ERROR,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
];
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertRaw(t('Epic upload FAIL!'), 'Found the failure message.');
$this
->assertFileHooksCalled([]);
}
public function testNoUpload() {
$this
->drupalPostForm('file-test/upload', [], t('Submit'));
$this
->assertNoRaw(t('Epic upload FAIL!'), 'Failure message not found.');
}
public function testDrupalMovingUploadedFileError() {
$test_directory = 'test_drupal_move_uploaded_file_fail';
$file_system = \Drupal::service('file_system');
$file_system
->mkdir('temporary://' . $test_directory, 00);
$this
->assertDirectoryExists('temporary://' . $test_directory);
$edit = [
'file_subdir' => $test_directory,
'files[file_test_upload]' => $file_system
->realpath($this->image
->getFileUri()),
];
\Drupal::state()
->set('file_test.disable_error_collection', TRUE);
$this
->drupalPostForm('file-test/upload', $edit, t('Submit'));
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertRaw(t('File upload error. Could not move uploaded file.'), 'Found the failure message.');
$this
->assertRaw(t('Epic upload FAIL!'), 'Found the failure message.');
$this
->drupalGet('admin/reports/dblog');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertRaw(t('Upload error. Could not move uploaded file @file to destination @destination.', [
'@file' => $this->image
->getFilename(),
'@destination' => 'temporary://' . $test_directory . '/' . $this->image
->getFilename(),
]), 'Found upload error log entry.');
}
public function testInvalidUtf8FilenameUpload() {
$this
->drupalGet('file-test/upload');
$filename = "";
$page = $this
->getSession()
->getPage();
$data = [
'multipart' => [
[
'name' => 'file_test_replace',
'contents' => FileSystemInterface::EXISTS_RENAME,
],
[
'name' => 'form_id',
'contents' => '_file_test_form',
],
[
'name' => 'form_build_id',
'contents' => $page
->find('hidden_field_selector', [
'hidden_field',
'form_build_id',
])
->getAttribute('value'),
],
[
'name' => 'form_token',
'contents' => $page
->find('hidden_field_selector', [
'hidden_field',
'form_token',
])
->getAttribute('value'),
],
[
'name' => 'op',
'contents' => 'Submit',
],
[
'name' => 'files[file_test_upload]',
'contents' => 'Test content',
'filename' => $filename,
],
],
'cookies' => $this
->getSessionCookies(),
'http_errors' => FALSE,
];
$this
->assertFileNotExists('temporary://' . $filename);
$response = $this
->getHttpClient()
->request('POST', Url::fromUri('base:file-test/upload')
->setAbsolute()
->toString(), $data);
$content = (string) $response
->getBody();
$this
->htmlOutput($content);
$error_text = new FormattableMarkup('The file %filename could not be uploaded because the name is invalid.', [
'%filename' => $filename,
]);
$this
->assertStringContainsString((string) $error_text, $content);
$this
->assertStringContainsString('Epic upload FAIL!', $content);
$this
->assertFileNotExists('temporary://' . $filename);
}
}