View source
<?php
namespace Drupal\Tests\file\Functional;
use Drupal\Component\Render\FormattableMarkup;
use Drupal\Core\File\FileSystemInterface;
use Drupal\Core\Url;
use Drupal\file\Entity\File;
use Drupal\Tests\TestFileCreationTrait;
class SaveUploadTest extends FileManagedTestBase {
use TestFileCreationTrait {
getTestFiles as drupalGetTestFiles;
}
protected static $modules = [
'dblog',
];
protected $defaultTheme = 'stark';
protected $image;
protected $phpfile;
protected $maxFidBefore;
protected $imageExtension;
protected function setUp() : void {
parent::setUp();
$account = $this
->drupalCreateUser([
'access site reports',
]);
$this
->drupalLogin($account);
$image_files = $this
->drupalGetTestFiles('image');
$this->image = File::create((array) current($image_files));
list(, $this->imageExtension) = explode('.', $this->image
->getFilename());
$this
->assertFileExists($this->image
->getFileUri());
$this->phpfile = current($this
->drupalGetTestFiles('php'));
$this
->assertFileExists($this->phpfile->uri);
$this->maxFidBefore = (int) \Drupal::entityQueryAggregate('file')
->accessCheck(FALSE)
->aggregate('fid', 'max')
->execute()[0]['fid_max'];
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextContains("You WIN!");
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
file_test_reset();
}
public function testNormal() {
$max_fid_after = (int) \Drupal::entityQueryAggregate('file')
->accessCheck(FALSE)
->aggregate('fid', 'max')
->execute()[0]['fid_max'];
$this
->assertGreaterThan($this->maxFidBefore, $max_fid_after);
$file1 = File::load($max_fid_after);
$this
->assertInstanceOf(File::class, $file1);
$this
->assertEquals('image', substr($file1
->getMimeType(), 0, 5), 'A MIME type was set.');
file_test_reset();
$image2 = current($this
->drupalGetTestFiles('image'));
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($image2->uri),
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextContains("You WIN!");
$max_fid_after = (int) \Drupal::entityQueryAggregate('file')
->accessCheck(FALSE)
->aggregate('fid', 'max')
->execute()[0]['fid_max'];
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
$file2 = File::load($max_fid_after);
$this
->assertInstanceOf(File::class, $file2);
$this
->assertEquals('image', substr($file2
->getMimeType(), 0, 5), 'A MIME type was set.');
$files = File::loadMultiple([
$file1
->id(),
$file2
->id(),
]);
$this
->assertTrue(isset($files[$file1
->id()]), 'File was loaded successfully');
$this
->assertTrue(isset($files[$file2
->id()]), 'File was loaded successfully');
$image3 = current($this
->drupalGetTestFiles('image'));
$image3_realpath = \Drupal::service('file_system')
->realpath($image3->uri);
$dir = $this
->randomMachineName();
$edit = [
'files[file_test_upload]' => $image3_realpath,
'file_subdir' => $dir,
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextContains("You WIN!");
$this
->assertFileExists('temporary://' . $dir . '/' . trim(\Drupal::service('file_system')
->basename($image3_realpath)));
}
public function testDuplicate() {
$image1 = current($this
->drupalGetTestFiles('image'));
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($image1->uri),
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$max_fid_after = (int) \Drupal::entityQueryAggregate('file')
->accessCheck(FALSE)
->aggregate('fid', 'max')
->execute()[0]['fid_max'];
$file1 = File::load($max_fid_after);
unlink(\Drupal::service('file_system')
->realpath($file1
->getFileUri()));
$image2 = $image1;
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($image2->uri),
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextContains("The file {$file1->getFileUri()} already exists. Enter a unique file URI.");
$max_fid_before_duplicate = $max_fid_after;
$max_fid_after = (int) \Drupal::entityQueryAggregate('file')
->accessCheck(FALSE)
->aggregate('fid', 'max')
->execute()[0]['fid_max'];
$this
->assertEquals($max_fid_before_duplicate, $max_fid_after, 'A new managed file was not created.');
}
public function testHandleExtension() {
$extensions = 'foo';
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
'extensions' => $extensions,
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->responseContains('Only files with the following extensions are allowed: <em class="placeholder">' . $extensions . '</em>');
$this
->assertSession()
->pageTextContains("Epic upload FAIL!");
$this
->assertFileHooksCalled([
'validate',
]);
file_test_reset();
$extensions = 'foo ' . $this->imageExtension;
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
'extensions' => $extensions,
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextNotContains("Only files with the following extensions are allowed:");
$this
->assertSession()
->pageTextContains("You WIN!");
$this
->assertFileHooksCalled([
'validate',
'load',
'update',
]);
file_test_reset();
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
'allow_all_extensions' => 'empty_array',
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextNotContains("Only files with the following extensions are allowed:");
$this
->assertSession()
->pageTextContains("You WIN!");
$this
->assertFileHooksCalled([
'validate',
'load',
'update',
]);
file_test_reset();
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->phpfile->uri),
'allow_all_extensions' => 'empty_array',
'is_image_file' => FALSE,
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->responseContains('For security reasons, your upload has been renamed to <em class="placeholder">' . $this->phpfile->filename . '_.txt' . '</em>');
$this
->assertSession()
->pageTextContains('File name is php-2.php_.txt.');
$this
->assertSession()
->pageTextContains('File MIME type is text/plain.');
$this
->assertSession()
->pageTextContains("You WIN!");
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
}
public function testHandleDangerousFile() {
$config = $this
->config('system.file');
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->phpfile->uri),
'is_image_file' => FALSE,
'extensions' => 'php txt',
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->responseContains('For security reasons, your upload has been renamed to <em class="placeholder">' . $this->phpfile->filename . '_.txt' . '</em>');
$this
->assertSession()
->pageTextContains('File name is php-2.php_.txt.');
$this
->assertSession()
->pageTextContains('File MIME type is text/plain.');
$this
->assertSession()
->pageTextContains("You WIN!");
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
$config
->set('allow_insecure_uploads', 1)
->save();
file_test_reset();
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextNotContains('For security reasons, your upload has been renamed');
$this
->assertSession()
->pageTextContains('File name is php-2.php.');
$this
->assertSession()
->pageTextContains("You WIN!");
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
file_test_reset();
$edit['extensions'] = 'foo';
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->responseContains('Only files with the following extensions are allowed: <em class="placeholder">' . $edit['extensions'] . '</em>');
$this
->assertSession()
->pageTextContains("Epic upload FAIL!");
$this
->assertFileHooksCalled([
'validate',
]);
file_test_reset();
$config
->set('allow_insecure_uploads', 0)
->save();
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->responseContains('Only files with the following extensions are allowed: <em class="placeholder">' . $edit['extensions'] . '</em>');
$this
->assertSession()
->pageTextContains("Epic upload FAIL!");
$this
->assertFileHooksCalled([
'validate',
]);
file_test_reset();
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->phpfile->uri),
'is_image_file' => FALSE,
'extensions' => 'php',
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextContains('For security reasons, your upload has been rejected.');
$this
->assertSession()
->pageTextContains('Epic upload FAIL!');
$this
->assertFileHooksCalled([
'validate',
]);
}
public function testHandleDotFile() {
$dot_file = $this->siteDirectory . '/.test';
file_put_contents($dot_file, 'This is a test');
$config = $this
->config('system.file');
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($dot_file),
'is_image_file' => FALSE,
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextContains('The specified file .test could not be uploaded');
$this
->assertSession()
->pageTextContains('Epic upload FAIL!');
$this
->assertFileHooksCalled([
'validate',
]);
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_RENAME,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($dot_file),
'is_image_file' => FALSE,
'allow_all_extensions' => 'empty_array',
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextContains('For security reasons, your upload has been renamed to test.');
$this
->assertSession()
->pageTextContains('File name is test.');
$this
->assertSession()
->pageTextContains('You WIN!');
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
file_test_reset();
$config
->set('allow_insecure_uploads', 0)
->save();
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextContains('For security reasons, your upload has been renamed to test_0.');
$this
->assertSession()
->pageTextContains('File name is test_0.');
$this
->assertSession()
->pageTextContains('You WIN!');
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
file_test_reset();
}
public function testHandleFileMunge() {
$this
->config('system.file')
->set('allow_insecure_uploads', 0)
->save();
$original_image_uri = $this->image
->getFileUri();
$this->image = file_move($this->image, $original_image_uri . '.foo.' . $this->imageExtension);
file_test_reset();
$extensions = $this->imageExtension;
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
'extensions' => $extensions,
];
$munged_filename = $this->image
->getFilename();
$munged_filename = substr($munged_filename, 0, strrpos($munged_filename, '.'));
$munged_filename .= '_.' . $this->imageExtension;
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextContains('For security reasons, your upload has been renamed');
$this
->assertSession()
->pageTextContains("File name is {$munged_filename}");
$this
->assertSession()
->pageTextContains("You WIN!");
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
file_test_reset();
$extensions = 'foo ' . $this->imageExtension;
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
'extensions' => $extensions,
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextNotContains('For security reasons, your upload has been renamed');
$this
->assertSession()
->pageTextContains("File name is {$this->image->getFilename()}");
$this
->assertSession()
->pageTextContains("You WIN!");
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
$this->image = file_move($this->image, $original_image_uri . '.foo.txt.' . $this->imageExtension);
file_test_reset();
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
'allow_all_extensions' => 'empty_array',
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextNotContains('For security reasons, your upload has been renamed');
$this
->assertSession()
->pageTextContains("File name is {$this->image->getFilename()}");
$this
->assertSession()
->pageTextContains("You WIN!");
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
$this->image = file_move($this->image, $original_image_uri . '.php.' . $this->imageExtension);
file_test_reset();
$extensions = 'php ' . $this->imageExtension;
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
'extensions' => $extensions,
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextContains('For security reasons, your upload has been renamed');
$this
->assertSession()
->pageTextContains("File name is image-test.png_.php_.png");
$this
->assertSession()
->pageTextContains("You WIN!");
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
file_test_reset();
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
'allow_all_extensions' => 'empty_array',
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextContains('For security reasons, your upload has been renamed');
$this
->assertSession()
->pageTextContains("File name is image-test.png_.php__0.png");
$this
->assertSession()
->pageTextContains("You WIN!");
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
$this->image = file_move($this->image, $original_image_uri . '.cgi.' . $this->imageExtension . '.txt');
file_test_reset();
$edit = [
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
'allow_all_extensions' => 'empty_array',
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextContains('For security reasons, your upload has been renamed');
$this
->assertSession()
->pageTextContains("File name is image-test.png_.cgi_.png_.txt");
$this
->assertSession()
->pageTextContains("You WIN!");
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
file_test_reset();
$edit = [
'files[file_test_upload][]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
'allow_all_extensions' => 'empty_string',
];
$this
->drupalGet('file-test/save_upload_from_form_test');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextNotContains('For security reasons, your upload has been renamed');
$this
->assertSession()
->pageTextContains("Epic upload FAIL!");
$this
->assertFileHooksCalled([
'validate',
]);
}
public function testExistingRename() {
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_RENAME,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextContains("You WIN!");
$this
->assertSession()
->pageTextContains('File name is image-test_0.png.');
$this
->assertFileHooksCalled([
'validate',
'insert',
]);
}
public function testExistingReplace() {
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_REPLACE,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextContains("You WIN!");
$this
->assertSession()
->pageTextContains('File name is image-test.png.');
$this
->assertFileHooksCalled([
'validate',
'load',
'update',
]);
}
public function testExistingError() {
$edit = [
'file_test_replace' => FileSystemInterface::EXISTS_ERROR,
'files[file_test_upload]' => \Drupal::service('file_system')
->realpath($this->image
->getFileUri()),
];
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextContains("Epic upload FAIL!");
$this
->assertFileHooksCalled([]);
}
public function testNoUpload() {
$this
->drupalGet('file-test/upload');
$this
->submitForm([], 'Submit');
$this
->assertSession()
->pageTextNotContains("Epic upload FAIL!");
}
public function testDrupalMovingUploadedFileError() {
$test_directory = 'test_drupal_move_uploaded_file_fail';
$file_system = \Drupal::service('file_system');
$file_system
->mkdir('temporary://' . $test_directory, 00);
$this
->assertDirectoryExists('temporary://' . $test_directory);
$edit = [
'file_subdir' => $test_directory,
'files[file_test_upload]' => $file_system
->realpath($this->image
->getFileUri()),
];
\Drupal::state()
->set('file_test.disable_error_collection', TRUE);
$this
->drupalGet('file-test/upload');
$this
->submitForm($edit, 'Submit');
$this
->assertSession()
->statusCodeEquals(200);
$this
->assertSession()
->pageTextContains('File upload error. Could not move uploaded file.');
$this
->assertSession()
->pageTextContains("Epic upload FAIL!");
$this
->drupalGet('admin/reports/dblog');
$this
->assertSession()
->statusCodeEquals(200);
$destination = 'temporary://' . $test_directory . '/' . $this->image
->getFilename();
$this
->assertSession()
->responseContains("Upload error. Could not move uploaded file {$this->image->getFilename()} to destination {$destination}.");
}
public function testInvalidUtf8FilenameUpload() {
$this
->drupalGet('file-test/upload');
$filename = "";
$page = $this
->getSession()
->getPage();
$data = [
'multipart' => [
[
'name' => 'file_test_replace',
'contents' => FileSystemInterface::EXISTS_RENAME,
],
[
'name' => 'form_id',
'contents' => '_file_test_form',
],
[
'name' => 'form_build_id',
'contents' => $page
->find('hidden_field_selector', [
'hidden_field',
'form_build_id',
])
->getAttribute('value'),
],
[
'name' => 'form_token',
'contents' => $page
->find('hidden_field_selector', [
'hidden_field',
'form_token',
])
->getAttribute('value'),
],
[
'name' => 'op',
'contents' => 'Submit',
],
[
'name' => 'files[file_test_upload]',
'contents' => 'Test content',
'filename' => $filename,
],
],
'cookies' => $this
->getSessionCookies(),
'http_errors' => FALSE,
];
$this
->assertFileDoesNotExist('temporary://' . $filename);
$response = $this
->getHttpClient()
->request('POST', Url::fromUri('base:file-test/upload')
->setAbsolute()
->toString(), $data);
$content = (string) $response
->getBody();
$this
->htmlOutput($content);
$error_text = new FormattableMarkup('The file %filename could not be uploaded because the name is invalid.', [
'%filename' => $filename,
]);
$this
->assertStringContainsString((string) $error_text, $content);
$this
->assertStringContainsString('Epic upload FAIL!', $content);
$this
->assertFileDoesNotExist('temporary://' . $filename);
}
}