function SaveUploadTest::testHandleDotFile

Same name and namespace in other branches
  1. 9 core/modules/file/tests/src/Functional/SaveUploadTest.php \Drupal\Tests\file\Functional\SaveUploadTest::testHandleDotFile()
  2. 11.x core/modules/file/tests/src/Functional/SaveUploadTest.php \Drupal\Tests\file\Functional\SaveUploadTest::testHandleDotFile()

Test dangerous file handling.

File

core/modules/file/tests/src/Functional/SaveUploadTest.php, line 386

Class

SaveUploadTest
Tests the file_save_upload() function.

Namespace

Drupal\Tests\file\Functional

Code

public function testHandleDotFile() : void {
  $dot_file = $this->siteDirectory . '/.test';
  file_put_contents($dot_file, 'This is a test');
  $config = $this->config('system.file');
  $edit = [
    'file_test_replace' => FileExists::Replace->name,
    'files[file_test_upload]' => \Drupal::service('file_system')->realpath($dot_file),
    'is_image_file' => FALSE,
  ];
  $this->drupalGet('file-test/upload');
  $this->submitForm($edit, 'Submit');
  $this->assertSession()
    ->statusCodeEquals(200);
  $this->assertSession()
    ->pageTextContains('The specified file .test could not be uploaded');
  $this->assertSession()
    ->pageTextContains('Epic upload FAIL!');
  // Check that the correct hooks were called.
  $this->assertFileHooksCalled([
    'validate',
  ]);
  $edit = [
    'file_test_replace' => FileExists::Rename->name,
    'files[file_test_upload]' => \Drupal::service('file_system')->realpath($dot_file),
    'is_image_file' => FALSE,
    'allow_all_extensions' => 'empty_array',
  ];
  $this->drupalGet('file-test/upload');
  $this->submitForm($edit, 'Submit');
  $this->assertSession()
    ->statusCodeEquals(200);
  $this->assertSession()
    ->pageTextContains('For security reasons, your upload has been renamed to test.');
  $this->assertSession()
    ->pageTextContains('File name is test.');
  $this->assertSession()
    ->pageTextContains('You WIN!');
  // Check that the correct hooks were called.
  $this->assertFileHooksCalled([
    'validate',
    'insert',
  ]);
  // Reset the hook counters.
  file_test_reset();
  // Turn off insecure uploads, then try the same thing as above to ensure dot
  // files are renamed regardless.
  $config->set('allow_insecure_uploads', 0)
    ->save();
  $this->drupalGet('file-test/upload');
  $this->submitForm($edit, 'Submit');
  $this->assertSession()
    ->statusCodeEquals(200);
  $this->assertSession()
    ->pageTextContains('For security reasons, your upload has been renamed to test_0.');
  $this->assertSession()
    ->pageTextContains('File name is test_0.');
  $this->assertSession()
    ->pageTextContains('You WIN!');
  // Check that the correct hooks were called.
  $this->assertFileHooksCalled([
    'validate',
    'insert',
  ]);
  // Reset the hook counters.
  file_test_reset();
}

Buggy or inaccurate documentation? Please file an issue. Need support? Need help programming? Connect with the Drupal community.