function ImageStyleDownloadAccessControlTest::testPublicThroughPrivateRoute

Ensures that public:// access is forbidden through image.style.private.

File

core/modules/image/tests/src/Functional/ImageStyleDownloadAccessControlTest.php, line 115

Class

ImageStyleDownloadAccessControlTest

Tests access control for downloading image styles.

Namespace

Code

public function testPublicThroughPrivateRoute() : void {
  $this->fileSystem
    ->copy(\Drupal::root() . '/core/tests/fixtures/files/image-1.png', 'public://image.png');
  $token = $this->style
    ->getPathToken('public://image.png');
  $private_route_public_scheme = Url::fromRoute('image.style_private', [
    'image_style' => $this->style
      ->id(),
    'scheme' => 'public',
  ])
    ->setAbsolute(TRUE);
  $generate_url = $private_route_public_scheme->toString() . '/image.png?itok=' . $token;
  $this->drupalGet($generate_url);
  $this->assertSession()
    ->statusCodeEquals(403);
}