ImageStyleDownloadAccessControlTest.php

<?php

declare (strict_types=1);
namespace Drupal\Tests\image\Functional;

use Drupal\Core\StreamWrapper\PublicStream;
use Drupal\Core\Url;
use Drupal\file\Entity\File;
use Drupal\image\Entity\ImageStyle;
use Drupal\Tests\BrowserTestBase;

/**
 * Tests access control for downloading image styles.
 *
 * @group image
 */
class ImageStyleDownloadAccessControlTest extends BrowserTestBase {
  
  /**
   * {@inheritdoc}
   */
  protected static $modules = [
    'image',
  ];
  
  /**
   * {@inheritdoc}
   */
  protected $defaultTheme = 'stark';
  
  /**
   * The file system.
   *
   * @var \Drupal\Core\File\FileSystemInterface
   */
  protected $fileSystem;
  
  /**
   * The image style.
   *
   * @var \Drupal\image\ImageStyleInterface
   */
  protected $style;
  
  /**
   * {@inheritdoc}
   */
  protected function prepareEnvironment() : void {
    parent::prepareEnvironment();
    // @see static::testPrivateSchemeWithinPublic()
    $this->privateFilesDirectory = $this->publicFilesDirectory . '/private';
  }
  
  /**
   * {@inheritdoc}
   */
  protected function setUp() : void {
    parent::setUp();
    $this->fileSystem = $this->container
      ->get('file_system');
    $this->style = ImageStyle::create([
      'name' => 'style_foo',
      'label' => $this->randomString(),
    ]);
    $this->style
      ->save();
    // Access control must be respected even when this setting is TRUE.
    $this->config('image.settings')
      ->set('allow_insecure_derivatives', TRUE)
      ->save();
  }
  
  /**
   * Ensures that private:// access is forbidden through image.style_public.
   */
  public function testPrivateThroughPublicRoute() : void {
    $this->fileSystem
      ->copy(\Drupal::root() . '/core/tests/fixtures/files/image-1.png', 'private://image.png');
    // Manually create the file record for the private:// file as we want it
    // to be temporary to pass hook_download() acl's.
    $values = [
      'uid' => $this->rootUser
        ->id(),
      'status' => 0,
      'filename' => 'image.png',
      'uri' => 'private://image.png',
      'filesize' => filesize('private://image.png'),
      'filemime' => 'image/png',
    ];
    $private_file = File::create($values);
    $private_file->save();
    $this->assertNotFalse(getimagesize($private_file->getFileUri()));
    $token = $this->style
      ->getPathToken('private://image.png');
    $public_route_private_scheme = Url::fromRoute('image.style_public', [
      'image_style' => $this->style
        ->id(),
      'scheme' => 'private',
    ])
      ->setAbsolute(TRUE);
    $generate_url = $public_route_private_scheme->toString() . '/image.png?itok=' . $token;
    $this->drupalLogin($this->rootUser);
    $this->drupalGet($generate_url);
    $this->drupalGet(PublicStream::basePath() . '/styles/' . $this->style
      ->id() . '/private/image.png');
    $this->assertSession()
      ->statusCodeEquals(403);
  }
  
  /**
   * Ensures that public:// access is forbidden through image.style.private.
   */
  public function testPublicThroughPrivateRoute() : void {
    $this->fileSystem
      ->copy(\Drupal::root() . '/core/tests/fixtures/files/image-1.png', 'public://image.png');
    $token = $this->style
      ->getPathToken('public://image.png');
    $private_route_public_scheme = Url::fromRoute('image.style_private', [
      'image_style' => $this->style
        ->id(),
      'scheme' => 'public',
    ])
      ->setAbsolute(TRUE);
    $generate_url = $private_route_public_scheme->toString() . '/image.png?itok=' . $token;
    $this->drupalGet($generate_url);
    $this->assertSession()
      ->statusCodeEquals(403);
  }

}