PHP Decode

<?php
 namespace Tests\Uploads; use BookStack\Entities\Repos\PageRepo; use BookStack\Uploads\Image; use BookStack\Uploads\ImageService; use Illuminate\Support\Str; use Tests\TestCase; class ImageTest extends TestCase { public function test_image_upload() { $page = $this->entities->page(); $admin = $this->users->admin(); $this->actingAs($admin); $imgDetails = $this->files->uploadGalleryImageToPage($this, $page); $relPath = $imgDetails["\x70\141\164\x68"]; $this->assertTrue(file_exists(public_path($relPath)), "\x55\160\x6c\157\141\x64\x65\144\x20\x69\155\141\x67\x65\x20\146\x6f\165\x6e\144\40\x61\x74\x20\x70\x61\x74\150\x3a\40" . public_path($relPath)); $this->files->deleteAtRelativePath($relPath); $this->assertDatabaseHas("\x69\155\141\x67\x65\x73", array("\165\x72\x6c" => $this->baseUrl . $relPath, "\x74\x79\x70\x65" => "\147\141\x6c\154\x65\x72\171", "\x75\160\154\157\x61\144\145\144\137\x74\157" => $page->id, "\x70\x61\x74\150" => $relPath, "\x63\x72\x65\x61\x74\x65\144\137\142\x79" => $admin->id, "\x75\x70\x64\141\164\145\x64\137\x62\171" => $admin->id, "\156\x61\155\x65" => $imgDetails["\156\141\x6d\x65"])); } public function test_image_display_thumbnail_generation_does_not_increase_image_size() { $page = $this->entities->page(); $admin = $this->users->admin(); $this->actingAs($admin); $originalFile = $this->files->testFilePath("\x63\x6f\x6d\x70\x72\145\x73\x73\145\144\x2e\x70\x6e\x67"); $originalFileSize = filesize($originalFile); $imgDetails = $this->files->uploadGalleryImageToPage($this, $page, "\x63\x6f\155\x70\162\145\163\x73\x65\x64\x2e\x70\x6e\x67"); $relPath = $imgDetails["\x70\x61\x74\x68"]; $this->assertTrue(file_exists(public_path($relPath)), "\125\x70\x6c\x6f\141\x64\x65\x64\x20\151\x6d\141\147\x65\40\146\x6f\x75\156\x64\40\141\164\x20\160\141\x74\150\72\x20" . public_path($relPath)); $displayImage = $imgDetails["\162\145\163\160\157\156\x73\145"]->thumbs->display; $displayImageRelPath = implode("\57", array_slice(explode("\x2f", $displayImage), 3)); $displayImagePath = public_path($displayImageRelPath); $displayFileSize = filesize($displayImagePath); $this->files->deleteAtRelativePath($relPath); $this->files->deleteAtRelativePath($displayImageRelPath); $this->assertEquals($originalFileSize, $displayFileSize, "\104\x69\163\x70\x6c\141\x79\x20\x74\x68\165\x6d\142\156\x61\151\x6c\40\147\145\x6e\145\x72\141\164\x69\x6f\x6e\40\x73\150\x6f\x75\x6c\144\x20\156\x6f\x74\x20\x69\156\x63\162\x65\141\x73\145\x20\x69\155\x61\x67\x65\40\163\151\172\145"); } public function test_image_display_thumbnail_generation_for_apng_images_uses_original_file() { $page = $this->entities->page(); $admin = $this->users->admin(); $this->actingAs($admin); $imgDetails = $this->files->uploadGalleryImageToPage($this, $page, "\x61\156\151\155\141\x74\145\144\56\160\156\x67"); $this->files->deleteAtRelativePath($imgDetails["\x70\141\164\x68"]); $this->assertStringContainsString("\x74\x68\165\x6d\142\x73\55", $imgDetails["\162\x65\163\160\157\156\x73\145"]->thumbs->gallery); $this->assertStringNotContainsString("\x74\150\x75\155\142\163\x2d", $imgDetails["\162\x65\x73\160\x6f\156\163\x65"]->thumbs->display); } public function test_image_edit() { $editor = $this->users->editor(); $this->actingAs($editor); $imgDetails = $this->files->uploadGalleryImageToPage($this, $this->entities->page()); $image = Image::query()->first(); $newName = Str::random(); $update = $this->put("\x2f\151\155\x61\147\145\x73\57" . $image->id, array("\x6e\x61\x6d\145" => $newName)); $update->assertSuccessful(); $update->assertSee($newName); $this->files->deleteAtRelativePath($imgDetails["\x70\x61\x74\x68"]); $this->assertDatabaseHas("\151\155\141\x67\x65\x73", array("\x74\x79\x70\145" => "\147\141\x6c\154\x65\x72\x79", "\x6e\x61\x6d\x65" => $newName)); } public function test_image_file_update() { $page = $this->entities->page(); $this->asEditor(); $imgDetails = $this->files->uploadGalleryImageToPage($this, $page); $relPath = $imgDetails["\x70\141\164\x68"]; $newUpload = $this->files->uploadedImage("\165\x70\144\141\164\x65\x64\55\151\x6d\141\x67\x65\56\160\x6e\147", "\x63\x6f\155\x70\162\x65\x73\x73\145\144\56\160\156\147"); $this->assertFileEquals($this->files->testFilePath("\164\x65\163\164\x2d\x69\155\141\x67\145\x2e\x70\x6e\147"), public_path($relPath)); $imageId = $imgDetails["\162\145\163\160\157\156\x73\x65"]->id; $image = Image::findOrFail($imageId); $image->updated_at = now()->subMonth(); $image->save(); $this->call("\x50\x55\x54", "\57\x69\x6d\x61\x67\x65\163\x2f{$imageId}\57\146\x69\x6c\145", array(), array(), array("\146\x69\x6c\145" => $newUpload))->assertOk(); $this->assertFileEquals($this->files->testFilePath("\143\x6f\x6d\x70\162\145\x73\x73\x65\144\56\160\x6e\x67"), public_path($relPath)); $image->refresh(); $this->assertTrue($image->updated_at->gt(now()->subMinute())); $this->files->deleteAtRelativePath($relPath); } public function test_image_file_update_does_not_allow_change_in_image_extension() { $page = $this->entities->page(); $this->asEditor(); $imgDetails = $this->files->uploadGalleryImageToPage($this, $page); $relPath = $imgDetails["\160\141\x74\x68"]; $newUpload = $this->files->uploadedImage("\165\x70\x64\141\164\145\144\x2d\x69\x6d\x61\147\145\56\152\x70\147", "\143\x6f\x6d\x70\x72\145\x73\x73\x65\x64\x2e\160\x6e\x67"); $imageId = $imgDetails["\162\145\x73\160\157\x6e\163\x65"]->id; $this->call("\120\125\x54", "\x2f\151\x6d\x61\147\x65\x73\57{$imageId}\x2f\x66\151\154\x65", array(), array(), array("\x66\x69\154\x65" => $newUpload))->assertJson(array("\155\145\x73\x73\141\x67\145" => "\x49\x6d\141\147\145\x20\146\151\x6c\x65\x20\x72\x65\160\x6c\141\143\x65\x6d\x65\156\164\163\40\155\x75\x73\164\x20\x62\145\x20\157\x66\40\x74\x68\x65\40\163\141\155\145\x20\164\x79\160\x65", "\x73\x74\141\164\x75\163" => "\145\162\x72\157\162")); $this->files->deleteAtRelativePath($relPath); } public function test_gallery_get_list_format() { $this->asEditor(); $imgDetails = $this->files->uploadGalleryImageToPage($this, $this->entities->page()); $image = Image::query()->first(); $pageId = $imgDetails["\x70\141\x67\x65"]->id; $firstPageRequest = $this->get("\57\x69\155\x61\147\x65\163\57\x67\141\154\x6c\x65\x72\171\77\x70\x61\x67\x65\x3d\61\46\165\x70\x6c\x6f\x61\x64\145\x64\137\164\x6f\x3d{$pageId}"); $firstPageRequest->assertSuccessful(); $this->withHtml($firstPageRequest)->assertElementExists("\x64\x69\x76"); $firstPageRequest->assertSuccessful()->assertSeeText($image->name); $secondPageRequest = $this->get("\x2f\151\x6d\x61\147\x65\163\57\147\x61\x6c\x6c\x65\x72\x79\77\160\141\x67\145\75\62\x26\x75\160\x6c\157\141\x64\x65\x64\137\x74\x6f\x3d{$pageId}"); $secondPageRequest->assertSuccessful(); $this->withHtml($secondPageRequest)->assertElementNotExists("\x64\x69\166"); $namePartial = substr($imgDetails["\156\141\155\145"], 0, 3); $searchHitRequest = $this->get("\x2f\x69\155\x61\147\145\x73\57\x67\141\x6c\154\x65\x72\x79\77\160\x61\x67\145\75\x31\x26\165\x70\154\157\141\144\x65\x64\137\164\157\75{$pageId}\46\x73\x65\x61\162\x63\x68\x3d{$namePartial}"); $searchHitRequest->assertSuccessful()->assertSee($imgDetails["\x6e\141\155\x65"]); $namePartial = Str::random(16); $searchFailRequest = $this->get("\x2f\151\x6d\x61\x67\145\163\x2f\147\141\154\x6c\145\162\x79\77\x70\x61\x67\x65\75\x31\x26\165\160\x6c\x6f\141\x64\145\x64\137\x74\157\x3d{$pageId}\x26\x73\x65\141\162\143\x68\x3d{$namePartial}"); $searchFailRequest->assertSuccessful()->assertDontSee($imgDetails["\x6e\141\x6d\x65"]); $searchFailRequest->assertSuccessful(); $this->withHtml($searchFailRequest)->assertElementNotExists("\144\151\166"); } public function test_image_gallery_lists_for_draft_page() { $this->actingAs($this->users->editor()); $draft = $this->entities->newDraftPage(); $this->files->uploadGalleryImageToPage($this, $draft); $image = Image::query()->where("\x75\160\x6c\x6f\141\144\x65\x64\137\164\x6f", "\75", $draft->id)->firstOrFail(); $resp = $this->get("\x2f\151\x6d\141\x67\x65\163\57\x67\141\x6c\x6c\x65\x72\x79\x3f\160\x61\x67\x65\75\x31\x26\x75\x70\x6c\x6f\141\144\x65\144\137\164\x6f\x3d{$draft->id}"); $resp->assertSee($image->getThumb(150, 150)); } public function test_image_usage() { $page = $this->entities->page(); $editor = $this->users->editor(); $this->actingAs($editor); $imgDetails = $this->files->uploadGalleryImageToPage($this, $page); $image = Image::query()->first(); $page->html = "\74\151\x6d\x67\x20\163\162\143\75\x22" . $image->url . "\42\x3e"; $page->save(); $usage = $this->get("\x2f\x69\x6d\x61\147\x65\163\x2f\145\144\151\164\57" . $image->id . "\77\144\x65\x6c\145\x74\145\x3d\164\162\x75\x65"); $usage->assertSuccessful(); $usage->assertSeeText($page->name); $usage->assertSee($page->getUrl()); $this->files->deleteAtRelativePath($imgDetails["\x70\141\164\x68"]); } public function test_php_files_cannot_be_uploaded() { $page = $this->entities->page(); $admin = $this->users->admin(); $this->actingAs($admin); $fileName = "\x62\x61\x64\x2e\160\x68\160"; $relPath = $this->files->expectedImagePath("\147\141\154\x6c\145\162\x79", $fileName); $this->files->deleteAtRelativePath($relPath); $file = $this->files->imageFromBase64File("\142\141\x64\55\160\x68\x70\x2e\x62\141\x73\145\66\64", $fileName); $upload = $this->withHeader("\103\157\x6e\164\145\x6e\x74\55\x54\171\x70\x65", "\x69\x6d\x61\147\x65\57\x6a\160\x65\147")->call("\x50\x4f\123\124", "\57\x69\155\x61\147\x65\163\57\x67\x61\x6c\154\145\x72\x79", array("\165\160\x6c\x6f\x61\x64\x65\144\137\x74\x6f" => $page->id), array(), array("\x66\x69\154\x65" => $file), array()); $upload->assertStatus(500); $this->assertStringContainsString("\124\x68\145\x20\x66\151\154\x65\40\x6d\x75\x73\x74\x20\x68\141\166\145\x20\141\x20\166\x61\x6c\151\144\40\x26\40\163\165\x70\x70\x6f\x72\164\x65\x64\40\151\x6d\141\147\x65\x20\145\x78\164\x65\156\x73\151\x6f\x6e", $upload->json("\155\x65\163\x73\x61\x67\x65")); $this->assertFalse(file_exists(public_path($relPath)), "\x55\160\154\157\x61\x64\x65\x64\40\160\x68\x70\x20\x66\151\x6c\145\40\167\141\x73\40\165\x70\x6c\157\141\x64\145\144\40\142\x75\x74\40\x73\150\157\x75\x6c\x64\40\x68\x61\x76\x65\40\142\145\145\156\x20\163\164\x6f\x70\x70\x65\144"); $this->assertDatabaseMissing("\151\x6d\141\147\x65\163", array("\x74\171\x70\x65" => "\x67\x61\154\154\x65\162\x79", "\x6e\x61\x6d\145" => $fileName)); } public function test_php_like_files_cannot_be_uploaded() { $page = $this->entities->page(); $admin = $this->users->admin(); $this->actingAs($admin); $fileName = "\142\x61\x64\56\x70\150\164\155\154"; $relPath = $this->files->expectedImagePath("\147\141\x6c\154\145\162\x79", $fileName); $this->files->deleteAtRelativePath($relPath); $file = $this->files->imageFromBase64File("\x62\141\x64\55\160\x68\x74\x6d\x6c\56\142\x61\x73\145\x36\x34", $fileName); $upload = $this->withHeader("\103\157\156\164\x65\x6e\164\55\124\x79\160\145", "\151\x6d\x61\147\145\x2f\152\160\x65\147")->call("\120\117\x53\124", "\57\x69\155\141\147\x65\x73\x2f\x67\x61\x6c\154\145\x72\x79", array("\165\160\x6c\x6f\141\144\x65\x64\137\x74\157" => $page->id), array(), array("\146\x69\154\145" => $file), array()); $upload->assertStatus(500); $this->assertStringContainsString("\124\150\x65\40\x66\151\154\x65\x20\x6d\165\x73\x74\40\150\x61\x76\145\x20\141\x20\x76\x61\x6c\x69\x64\x20\46\40\x73\x75\160\x70\157\162\x74\145\144\x20\x69\155\x61\147\x65\40\145\170\164\x65\156\163\x69\x6f\x6e", $upload->json("\x6d\145\163\163\x61\x67\145")); $this->assertFalse(file_exists(public_path($relPath)), "\x55\160\x6c\157\141\144\145\x64\40\x70\x68\x70\x20\146\x69\154\145\x20\x77\141\163\40\x75\160\x6c\157\141\x64\x65\144\40\142\x75\164\x20\x73\150\x6f\165\x6c\x64\40\x68\141\x76\x65\x20\x62\x65\145\156\x20\163\164\x6f\x70\x70\x65\x64"); } public function test_files_with_double_extensions_will_get_sanitized() { $page = $this->entities->page(); $admin = $this->users->admin(); $this->actingAs($admin); $fileName = "\x62\141\144\x2e\x70\150\x74\155\x6c\56\160\156\147"; $relPath = $this->files->expectedImagePath("\147\141\154\154\x65\x72\x79", $fileName); $expectedRelPath = dirname($relPath) . "\x2f\x62\x61\x64\x2d\160\x68\x74\x6d\x6c\56\x70\156\x67"; $this->files->deleteAtRelativePath($expectedRelPath); $file = $this->files->imageFromBase64File("\x62\141\x64\x2d\160\x68\164\x6d\x6c\x2d\160\x6e\147\x2e\142\141\163\145\66\64", $fileName); $upload = $this->withHeader("\103\x6f\156\x74\145\x6e\164\55\124\x79\x70\145", "\x69\155\x61\x67\145\57\160\156\x67")->call("\120\117\123\x54", "\57\151\x6d\x61\x67\145\x73\x2f\147\141\154\154\145\x72\171", array("\x75\x70\154\157\141\x64\145\144\137\164\x6f" => $page->id), array(), array("\x66\x69\154\145" => $file), array()); $upload->assertStatus(200); $lastImage = Image::query()->latest("\x69\x64")->first(); $this->assertEquals("\x62\141\144\x2e\160\x68\164\x6d\154\56\x70\x6e\147", $lastImage->name); $this->assertEquals("\x62\x61\144\55\160\150\164\155\x6c\56\160\156\x67", basename($lastImage->path)); $this->assertFileDoesNotExist(public_path($relPath), "\x55\160\x6c\157\x61\144\145\x64\x20\x69\x6d\141\147\145\x20\146\x69\x6c\145\x20\x6e\x61\x6d\x65\40\x77\141\x73\40\x6e\x6f\164\x20\163\164\x72\151\x70\x70\x65\x64\x20\157\146\40\x64\157\x74\x73"); $this->assertFileExists(public_path($expectedRelPath)); $this->files->deleteAtRelativePath($lastImage->path); } public function test_url_entities_removed_from_filenames() { $this->asEditor(); $badNames = array("\142\x61\144\x2d\x63\150\x61\162\x2d\43\55\151\x6d\141\x67\145\56\160\x6e\147", "\142\x61\x64\55\x63\x68\x61\162\x2d\x3f\55\151\155\x61\x67\145\56\160\x6e\147", "\x3f\x23\x2e\160\x6e\147", "\x3f\x2e\160\x6e\x67", "\43\56\x70\156\147"); foreach ($badNames as $name) { $galleryFile = $this->files->uploadedImage($name); $page = $this->entities->page(); $badPath = $this->files->expectedImagePath("\147\x61\154\154\145\162\171", $name); $this->files->deleteAtRelativePath($badPath); $upload = $this->call("\120\117\x53\x54", "\x2f\151\155\x61\x67\x65\x73\57\147\x61\154\x6c\145\x72\x79", array("\165\160\x6c\157\x61\144\145\144\137\x74\x6f" => $page->id), array(), array("\146\151\154\145" => $galleryFile), array()); $upload->assertStatus(200); $lastImage = Image::query()->latest("\x69\144")->first(); $newFileName = explode("\x2e", basename($lastImage->path))[0]; $this->assertEquals($lastImage->name, $name); $this->assertFalse(strpos($lastImage->path, $name), "\x50\x61\x74\150\x20\x63\x6f\156\164\x61\x69\x6e\x73\40\157\x72\x69\147\x69\156\x61\x6c\x20\151\x6d\141\x67\x65\x20\x6e\141\x6d\145"); $this->assertFalse(file_exists(public_path($badPath)), "\x55\x70\154\157\x61\144\145\x64\40\151\x6d\141\x67\145\x20\146\x69\x6c\x65\x20\x6e\x61\x6d\x65\x20\x77\x61\163\40\x6e\157\164\x20\x73\x74\162\151\160\x70\145\144\40\x6f\x66\x20\x75\162\x6c\40\x65\156\164\151\164\151\x65\x73"); $this->assertTrue(strlen($newFileName) > 0, "\x46\151\154\x65\40\x6e\x61\155\145\x20\x77\141\163\40\162\145\x64\165\x63\x65\144\40\164\157\x20\156\x6f\164\x68\151\x6e\x67"); $this->files->deleteAtRelativePath($lastImage->path); } } public function test_secure_images_uploads_to_correct_place() { config()->set("\146\x69\x6c\x65\163\171\163\164\145\155\x73\56\x69\x6d\x61\x67\x65\163", "\154\x6f\143\x61\154\137\163\145\143\165\162\x65"); $this->asEditor(); $galleryFile = $this->files->uploadedImage("\155\x79\x2d\163\x65\x63\x75\162\x65\x2d\x74\145\163\x74\55\165\160\154\x6f\x61\144\x2e\160\156\147"); $page = $this->entities->page(); $expectedPath = storage_path("\165\160\154\x6f\141\x64\x73\57\x69\x6d\x61\x67\x65\x73\57\x67\x61\x6c\x6c\145\162\x79\57" . date("\131\55\x6d") . "\x2f\x6d\171\x2d\x73\x65\143\x75\162\x65\x2d\164\145\163\x74\x2d\x75\160\154\x6f\x61\144\x2e\160\x6e\147"); $upload = $this->call("\x50\x4f\123\124", "\57\151\x6d\x61\x67\145\x73\57\147\141\x6c\154\x65\162\x79", array("\x75\160\x6c\x6f\141\x64\145\144\x5f\164\157" => $page->id), array(), array("\x66\151\x6c\x65" => $galleryFile), array()); $upload->assertStatus(200); $this->assertTrue(file_exists($expectedPath), "\125\160\154\x6f\x61\144\x65\144\x20\151\155\141\147\145\40\x6e\x6f\164\40\146\x6f\165\x6e\144\40\141\164\40\160\x61\164\150\72\x20" . $expectedPath); if (file_exists($expectedPath)) { unlink($expectedPath); } } public function test_secure_image_paths_traversal_causes_500() { config()->set("\146\151\154\x65\163\171\163\164\x65\155\163\x2e\x69\155\141\x67\145\163", "\154\157\143\141\x6c\x5f\x73\x65\x63\x75\x72\145"); $this->asEditor(); $resp = $this->get("\57\165\x70\154\x6f\141\144\163\57\151\x6d\x61\x67\x65\163\x2f\x2e\x2e\x2f\x2e\56\57\x6c\157\x67\163\x2f\154\141\x72\x61\166\145\154\56\154\157\x67"); $resp->assertStatus(500); } public function test_secure_image_paths_traversal_on_non_secure_images_causes_404() { config()->set("\x66\x69\154\145\x73\171\x73\x74\x65\155\x73\56\151\x6d\x61\x67\145\163", "\x6c\x6f\x63\141\154"); $this->asEditor(); $resp = $this->get("\x2f\165\160\x6c\157\141\x64\163\x2f\x69\155\x61\147\x65\163\x2f\x2e\x2e\x2f\56\x2e\x2f\154\x6f\x67\163\57\x6c\141\162\141\x76\145\154\56\x6c\x6f\x67"); $resp->assertStatus(404); } public function test_secure_image_paths_dont_serve_non_images() { config()->set("\x66\151\x6c\145\x73\x79\163\x74\x65\x6d\x73\x2e\x69\155\141\x67\145\163", "\154\157\143\141\154\137\x73\145\x63\165\162\145"); $this->asEditor(); $testFilePath = storage_path("\57\165\160\x6c\157\141\144\x73\57\x69\x6d\141\x67\145\x73\57\x74\x65\163\x74\151\x6e\x67\x2e\x74\x78\x74"); file_put_contents($testFilePath, "\150\145\154\x6c\157\40\146\x72\x6f\x6d\40\164\145\x73\164\x5f\163\145\x63\x75\x72\x65\x5f\x69\155\141\x67\145\137\160\141\164\x68\x73\x5f\x64\157\156\164\137\163\x65\162\166\x65\137\x6e\x6f\156\137\x69\x6d\x61\x67\x65\163"); $resp = $this->get("\57\x75\160\154\x6f\x61\x64\163\x2f\151\155\141\x67\x65\163\x2f\x74\145\x73\164\x69\156\x67\56\164\170\164"); $resp->assertStatus(404); } public function test_secure_images_included_in_exports() { config()->set("\x66\151\x6c\x65\163\x79\x73\x74\145\x6d\x73\56\x69\x6d\x61\x67\x65\x73", "\x6c\x6f\143\141\154\x5f\163\145\x63\165\x72\145"); $this->asEditor(); $galleryFile = $this->files->uploadedImage("\x6d\x79\55\163\x65\143\x75\x72\145\x2d\164\145\163\x74\x2d\165\x70\154\x6f\x61\144\56\160\x6e\147"); $page = $this->entities->page(); $expectedPath = storage_path("\165\160\154\157\141\144\x73\57\x69\x6d\x61\x67\145\x73\x2f\x67\141\154\154\145\162\171\x2f" . date("\x59\x2d\155") . "\x2f\x6d\x79\x2d\163\x65\143\x75\162\145\55\x74\145\163\x74\55\x75\x70\154\x6f\x61\144\x2e\x70\156\x67"); $upload = $this->call("\120\117\123\124", "\57\x69\155\x61\x67\x65\163\x2f\147\x61\154\154\145\x72\171", array("\x75\x70\154\x6f\141\x64\145\x64\x5f\x74\157" => $page->id), array(), array("\146\x69\154\x65" => $galleryFile), array()); $imageUrl = json_decode($upload->getContent(), true)["\x75\162\154"]; $page->html .= "\x3c\x69\155\x67\x20\163\162\x63\75\42{$imageUrl}\42\x3e"; $page->save(); $upload->assertStatus(200); $encodedImageContent = base64_encode(file_get_contents($expectedPath)); $export = $this->get($page->getUrl("\x2f\145\170\160\x6f\162\x74\57\150\164\x6d\x6c")); $this->assertTrue(strpos($export->getContent(), $encodedImageContent) !== false, "\125\160\154\157\x61\144\145\x64\40\x69\155\x61\147\145\x20\151\x6e\x20\x65\170\160\x6f\x72\164\x20\143\x6f\156\x74\x65\156\x74"); if (file_exists($expectedPath)) { unlink($expectedPath); } } public function test_system_images_remain_public_with_local_secure() { config()->set("\x66\x69\x6c\145\163\171\x73\x74\x65\155\163\x2e\151\x6d\x61\147\145\163", "\x6c\x6f\143\141\154\x5f\163\145\x63\x75\162\x65"); $this->asAdmin(); $galleryFile = $this->files->uploadedImage("\x6d\171\55\163\x79\163\x74\x65\155\x2d\x74\x65\x73\x74\55\165\160\154\x6f\x61\x64\x2e\160\156\x67"); $expectedPath = public_path("\165\x70\154\x6f\141\x64\163\x2f\x69\155\x61\147\145\163\57\163\171\x73\164\x65\155\57" . date("\x59\x2d\155") . "\57\155\x79\x2d\163\171\x73\164\145\x6d\55\x74\145\163\164\x2d\165\x70\154\157\141\144\x2e\x70\x6e\147"); $upload = $this->call("\x50\x4f\123\x54", "\57\x73\145\164\x74\151\x6e\147\x73\57\143\x75\163\x74\157\155\x69\x7a\141\164\151\x6f\x6e", array(), array(), array("\141\x70\160\x5f\154\157\147\157" => $galleryFile), array()); $upload->assertRedirect("\57\x73\145\x74\x74\x69\156\x67\163\57\x63\x75\163\x74\x6f\x6d\151\172\141\164\151\x6f\156"); $this->assertTrue(file_exists($expectedPath), "\x55\160\x6c\x6f\141\x64\145\144\40\x69\155\x61\x67\x65\40\156\x6f\164\x20\146\157\x75\156\x64\x20\141\x74\x20\160\x61\x74\x68\x3a\x20" . $expectedPath); if (file_exists($expectedPath)) { unlink($expectedPath); } } public function test_secure_images_not_tracked_in_session_history() { config()->set("\x66\151\154\x65\163\x79\x73\164\145\155\x73\x2e\x69\x6d\x61\147\145\163", "\x6c\x6f\x63\x61\154\x5f\x73\x65\x63\165\162\145"); $this->asEditor(); $page = $this->entities->page(); $result = $this->files->uploadGalleryImageToPage($this, $page); $expectedPath = storage_path($result["\x70\141\x74\x68"]); $this->assertFileExists($expectedPath); $this->get("\x2f\142\x6f\x6f\x6b\163"); $this->assertEquals(url("\x2f\142\x6f\x6f\x6b\x73"), session()->previousUrl()); $resp = $this->get($result["\x70\141\x74\150"]); $resp->assertOk(); $resp->assertHeader("\103\x6f\156\x74\x65\156\164\x2d\x54\x79\x70\145", "\x69\155\141\147\145\57\x70\156\x67"); $this->assertEquals(url("\x2f\142\157\157\x6b\x73"), session()->previousUrl()); if (file_exists($expectedPath)) { unlink($expectedPath); } } public function test_system_images_remain_public_with_local_secure_restricted() { config()->set("\x66\x69\x6c\x65\x73\x79\x73\x74\x65\x6d\163\56\151\155\141\147\x65\163", "\x6c\x6f\x63\141\x6c\137\163\145\143\x75\x72\145\137\x72\x65\163\164\162\151\143\164\145\144"); $this->asAdmin(); $galleryFile = $this->files->uploadedImage("\155\171\55\163\x79\163\x74\x65\155\55\x74\145\163\x74\55\x72\145\163\x74\x72\x69\143\x74\145\x64\55\165\160\154\x6f\141\144\56\160\x6e\147"); $expectedPath = public_path("\x75\x70\154\157\x61\x64\x73\x2f\x69\155\141\147\145\163\57\163\171\x73\164\x65\x6d\57" . date("\x59\x2d\x6d") . "\x2f\x6d\x79\55\163\171\163\164\145\x6d\55\164\145\163\x74\55\x72\x65\x73\164\x72\x69\143\x74\x65\x64\x2d\165\x70\x6c\157\x61\144\56\x70\x6e\x67"); $upload = $this->call("\120\x4f\123\x54", "\57\163\145\x74\x74\x69\x6e\x67\163\57\143\x75\x73\164\x6f\155\151\172\141\164\151\x6f\x6e", array(), array(), array("\x61\160\160\x5f\x6c\x6f\147\157" => $galleryFile), array()); $upload->assertRedirect("\57\x73\145\164\164\151\156\x67\163\57\x63\x75\x73\x74\x6f\155\x69\x7a\141\164\x69\157\x6e"); $this->assertTrue(file_exists($expectedPath), "\125\160\154\x6f\141\x64\145\144\40\x69\155\141\x67\145\40\x6e\x6f\x74\40\x66\157\x75\156\144\x20\141\164\x20\x70\x61\164\x68\x3a\40" . $expectedPath); if (file_exists($expectedPath)) { unlink($expectedPath); } } public function test_secure_restricted_images_inaccessible_without_relation_permission() { config()->set("\146\151\154\145\x73\171\x73\164\x65\x6d\163\56\151\x6d\x61\x67\145\x73", "\154\x6f\x63\x61\x6c\x5f\x73\x65\143\165\x72\145\x5f\162\145\163\164\162\x69\x63\164\x65\x64"); $this->asEditor(); $galleryFile = $this->files->uploadedImage("\x6d\171\55\163\x65\x63\x75\x72\x65\55\162\x65\x73\164\162\151\x63\164\145\x64\55\x74\x65\x73\x74\x2d\165\160\154\157\141\x64\56\160\x6e\147"); $page = $this->entities->page(); $upload = $this->call("\x50\117\123\124", "\x2f\x69\x6d\x61\147\x65\163\57\x67\141\x6c\154\x65\162\171", array("\165\160\154\157\x61\144\145\x64\x5f\x74\x6f" => $page->id), array(), array("\x66\x69\154\145" => $galleryFile), array()); $upload->assertStatus(200); $expectedUrl = url("\x75\x70\x6c\157\x61\144\x73\57\151\x6d\141\x67\145\163\57\147\141\154\154\x65\x72\171\x2f" . date("\131\55\x6d") . "\x2f\155\x79\x2d\x73\145\x63\165\x72\145\x2d\162\145\163\x74\x72\151\x63\164\x65\x64\x2d\164\x65\x73\x74\x2d\165\160\x6c\x6f\x61\144\x2e\160\x6e\x67"); $expectedPath = storage_path("\165\x70\154\x6f\x61\144\163\57\151\155\141\147\145\x73\x2f\x67\141\x6c\x6c\x65\162\x79\57" . date("\x59\x2d\x6d") . "\x2f\x6d\171\x2d\163\145\143\165\162\145\x2d\x72\x65\163\x74\x72\151\143\164\x65\144\x2d\164\x65\163\164\x2d\165\160\x6c\157\141\x64\x2e\x70\x6e\x67"); $this->get($expectedUrl)->assertOk(); $this->permissions->setEntityPermissions($page, array(), array()); $resp = $this->get($expectedUrl); $resp->assertNotFound(); if (file_exists($expectedPath)) { unlink($expectedPath); } } public function test_thumbnail_path_handled_by_secure_restricted_images() { config()->set("\146\x69\154\x65\163\171\x73\x74\145\x6d\x73\x2e\151\155\141\x67\145\163", "\x6c\157\143\x61\x6c\x5f\x73\145\143\x75\162\x65\137\x72\x65\163\x74\162\x69\x63\164\x65\x64"); $this->asEditor(); $galleryFile = $this->files->uploadedImage("\155\x79\55\x73\145\x63\165\162\145\55\x72\x65\x73\x74\x72\151\x63\x74\x65\144\x2d\x74\150\165\155\142\x2d\164\x65\163\x74\55\x74\145\x73\x74\x2e\x70\156\x67"); $page = $this->entities->page(); $upload = $this->call("\x50\x4f\123\x54", "\x2f\151\155\141\147\x65\163\x2f\147\x61\x6c\154\x65\x72\171", array("\165\x70\154\157\x61\x64\145\144\x5f\164\x6f" => $page->id), array(), array("\x66\151\154\x65" => $galleryFile), array()); $upload->assertStatus(200); $expectedUrl = url("\165\x70\x6c\x6f\x61\x64\163\x2f\151\x6d\x61\147\145\x73\57\x67\141\x6c\154\x65\162\x79\57" . date("\131\x2d\x6d") . "\x2f\164\150\x75\x6d\142\x73\55\61\x35\x30\55\x31\x35\60\57\155\171\55\x73\x65\143\165\162\145\x2d\162\145\163\164\x72\151\143\x74\145\144\x2d\164\150\x75\x6d\x62\55\x74\x65\163\x74\x2d\x74\145\x73\x74\56\160\156\147"); $expectedPath = storage_path("\x75\160\x6c\157\x61\144\x73\x2f\151\x6d\141\x67\145\x73\57\147\x61\154\x6c\x65\x72\x79\x2f" . date("\x59\x2d\155") . "\57\155\171\55\x73\145\143\x75\x72\145\x2d\162\145\163\164\162\151\143\164\145\x64\x2d\x74\x68\165\155\142\x2d\x74\145\x73\x74\x2d\x74\145\163\x74\x2e\x70\156\147"); $this->get($expectedUrl)->assertOk(); $this->permissions->setEntityPermissions($page, array(), array()); $resp = $this->get($expectedUrl); $resp->assertNotFound(); if (file_exists($expectedPath)) { unlink($expectedPath); } } public function test_secure_restricted_image_access_controlled_in_exports() { config()->set("\146\151\x6c\x65\163\171\x73\x74\145\x6d\x73\56\151\155\141\147\x65\x73", "\154\x6f\x63\141\154\x5f\163\x65\x63\x75\x72\145\137\x72\145\x73\164\162\151\143\x74\145\144"); $this->asEditor(); $galleryFile = $this->files->uploadedImage("\155\x79\55\163\x65\x63\165\x72\x65\x2d\x72\145\163\x74\x72\151\143\164\x65\x64\x2d\145\170\x70\157\162\x74\x2d\164\x65\x73\164\56\x70\156\x67"); $pageA = $this->entities->page(); $pageB = $this->entities->page(); $expectedPath = storage_path("\x75\x70\x6c\x6f\141\x64\163\x2f\x69\x6d\x61\x67\145\163\57\x67\x61\154\154\145\162\x79\x2f" . date("\x59\x2d\x6d") . "\57\x6d\x79\x2d\x73\145\x63\x75\x72\145\x2d\162\x65\163\x74\x72\x69\143\x74\x65\144\x2d\145\170\160\x6f\x72\164\55\164\x65\x73\164\x2e\160\x6e\147"); $upload = $this->asEditor()->call("\x50\x4f\x53\124", "\x2f\151\155\141\x67\145\163\57\x67\141\154\x6c\x65\x72\171", array("\165\160\154\x6f\x61\x64\145\x64\137\x74\157" => $pageA->id), array(), array("\x66\151\154\145" => $galleryFile), array()); $upload->assertOk(); $imageUrl = json_decode($upload->getContent(), true)["\x75\162\154"]; $pageB->html .= "\x3c\151\x6d\x67\40\x73\162\x63\x3d\x22{$imageUrl}\x22\76"; $pageB->save(); $encodedImageContent = base64_encode(file_get_contents($expectedPath)); $export = $this->get($pageB->getUrl("\x2f\145\170\x70\157\x72\164\x2f\150\164\x6d\x6c")); $this->assertStringContainsString($encodedImageContent, $export->getContent()); $this->permissions->setEntityPermissions($pageA, array(), array()); $export = $this->get($pageB->getUrl("\x2f\x65\170\x70\x6f\162\x74\57\150\164\155\154")); $this->assertStringNotContainsString($encodedImageContent, $export->getContent()); if (file_exists($expectedPath)) { unlink($expectedPath); } } public function test_image_delete() { $page = $this->entities->page(); $this->asAdmin(); $imageName = "\146\x69\x72\x73\x74\x2d\151\155\141\x67\x65\56\x70\x6e\147"; $relPath = $this->files->expectedImagePath("\147\141\x6c\154\x65\x72\x79", $imageName); $this->files->deleteAtRelativePath($relPath); $this->files->uploadGalleryImage($this, $imageName, $page->id); $image = Image::first(); $delete = $this->delete("\57\x69\x6d\x61\x67\x65\x73\57" . $image->id); $delete->assertStatus(200); $this->assertDatabaseMissing("\151\155\x61\147\x65\x73", array("\x75\x72\x6c" => $this->baseUrl . $relPath, "\x74\171\x70\x65" => "\x67\x61\154\x6c\x65\162\x79")); $this->assertFalse(file_exists(public_path($relPath)), "\x55\x70\x6c\x6f\x61\144\145\x64\x20\151\x6d\x61\147\145\x20\150\x61\x73\x20\156\157\164\x20\x62\145\145\x6e\x20\144\x65\x6c\145\164\145\144\40\x61\x73\40\145\x78\160\145\x63\164\x65\x64"); } public function test_image_delete_does_not_delete_similar_images() { $page = $this->entities->page(); $this->asAdmin(); $imageName = "\x66\x69\x72\x73\x74\x2d\x69\x6d\x61\147\x65\x2e\160\x6e\147"; $relPath = $this->files->expectedImagePath("\x67\141\x6c\154\145\162\x79", $imageName); $this->files->deleteAtRelativePath($relPath); $this->files->uploadGalleryImage($this, $imageName, $page->id); $this->files->uploadGalleryImage($this, $imageName, $page->id); $this->files->uploadGalleryImage($this, $imageName, $page->id); $image = Image::first(); $folder = public_path(dirname($relPath)); $imageCount = count(glob($folder . "\x2f\52")); $delete = $this->delete("\57\x69\155\x61\147\145\x73\57" . $image->id); $delete->assertStatus(200); $newCount = count(glob($folder . "\x2f\x2a")); $this->assertEquals($imageCount - 1, $newCount, "\x4d\157\x72\x65\40\x66\151\x6c\x65\163\x20\164\150\141\156\40\x65\x78\x70\145\143\164\x65\x64\40\x68\x61\166\145\40\142\x65\x65\x6e\x20\144\145\x6c\145\164\x65\144"); $this->assertFalse(file_exists(public_path($relPath)), "\125\x70\154\x6f\141\144\145\144\40\x69\x6d\x61\x67\145\x20\x68\x61\x73\40\x6e\157\x74\40\x62\x65\145\x6e\40\x64\145\x6c\x65\x74\145\x64\x20\141\163\40\145\x78\160\145\143\164\145\x64"); } public function test_image_manager_delete_button_only_shows_with_permission() { $page = $this->entities->page(); $this->asAdmin(); $imageName = "\146\x69\162\x73\164\x2d\x69\x6d\141\147\x65\x2e\x70\156\147"; $relPath = $this->files->expectedImagePath("\x67\x61\154\x6c\x65\162\x79", $imageName); $this->files->deleteAtRelativePath($relPath); $viewer = $this->users->viewer(); $this->files->uploadGalleryImage($this, $imageName, $page->id); $image = Image::first(); $resp = $this->get("\57\x69\x6d\141\x67\x65\163\57\145\144\x69\x74\57{$image->id}"); $this->withHtml($resp)->assertElementExists("\142\x75\x74\x74\157\x6e\43\151\x6d\x61\147\x65\55\155\x61\x6e\x61\x67\x65\x72\55\144\x65\154\x65\x74\145"); $resp = $this->actingAs($viewer)->get("\x2f\151\155\141\x67\x65\163\57\145\x64\x69\x74\x2f{$image->id}"); $this->withHtml($resp)->assertElementNotExists("\x62\165\164\164\157\x6e\x23\x69\x6d\141\x67\145\x2d\x6d\141\156\x61\x67\x65\162\x2d\x64\x65\x6c\145\x74\145"); $this->permissions->grantUserRolePermissions($viewer, array("\151\x6d\x61\147\145\x2d\x64\x65\x6c\x65\164\145\55\x61\154\154")); $resp = $this->actingAs($viewer)->get("\57\151\155\141\x67\x65\163\x2f\145\x64\x69\x74\57{$image->id}"); $this->withHtml($resp)->assertElementExists("\142\x75\x74\164\157\156\x23\x69\155\141\x67\145\x2d\x6d\141\156\x61\147\x65\162\55\144\145\x6c\x65\164\x65"); $this->files->deleteAtRelativePath($relPath); } public function test_image_manager_regen_thumbnails() { $this->asEditor(); $imageName = "\146\151\x72\x73\x74\x2d\151\155\141\x67\145\56\160\x6e\147"; $relPath = $this->files->expectedImagePath("\x67\x61\154\154\x65\162\171", $imageName); $this->files->deleteAtRelativePath($relPath); $this->files->uploadGalleryImage($this, $imageName, $this->entities->page()->id); $image = Image::first(); $resp = $this->get("\x2f\x69\155\x61\147\145\163\57\x65\144\x69\164\57{$image->id}"); $this->withHtml($resp)->assertElementExists("\x62\x75\x74\164\157\x6e\x23\x69\155\x61\x67\x65\x2d\x6d\x61\156\x61\x67\145\162\55\x72\x65\x62\x75\x69\154\x64\x2d\x74\x68\x75\x6d\142\x73"); $expectedThumbPath = dirname($relPath) . "\x2f\x73\143\x61\x6c\145\144\x2d\61\66\70\60\55\57" . basename($relPath); $this->files->deleteAtRelativePath($expectedThumbPath); $this->assertFileDoesNotExist($this->files->relativeToFullPath($expectedThumbPath)); $resp = $this->put("\57\x69\155\x61\x67\145\x73\x2f{$image->id}\57\162\145\x62\165\151\x6c\x64\55\164\x68\165\x6d\142\156\x61\x69\154\163"); $resp->assertOk(); $this->assertFileExists($this->files->relativeToFullPath($expectedThumbPath)); $this->files->deleteAtRelativePath($relPath); } protected function getTestProfileImage() { $imageName = "\x70\x72\157\x66\x69\154\x65\x2e\160\x6e\147"; $relPath = $this->files->expectedImagePath("\165\x73\x65\x72", $imageName); $this->files->deleteAtRelativePath($relPath); return $this->files->uploadedImage($imageName); } public function test_user_image_upload() { $editor = $this->users->editor(); $admin = $this->users->admin(); $this->actingAs($admin); $file = $this->getTestProfileImage(); $this->call("\x50\125\124", "\57\163\x65\x74\x74\x69\x6e\x67\163\x2f\x75\163\x65\x72\x73\x2f" . $editor->id, array(), array(), array("\x70\162\157\146\x69\x6c\x65\137\x69\155\x61\x67\145" => $file), array()); $this->assertDatabaseHas("\x69\x6d\x61\147\145\163", array("\164\171\160\145" => "\x75\x73\x65\162", "\x75\160\x6c\157\x61\x64\145\x64\137\x74\x6f" => $editor->id, "\143\x72\x65\x61\x74\x65\144\x5f\x62\x79" => $admin->id)); } public function test_user_images_deleted_on_user_deletion() { $editor = $this->users->editor(); $this->actingAs($editor); $file = $this->getTestProfileImage(); $this->call("\120\125\x54", "\x2f\x6d\171\x2d\x61\143\143\x6f\x75\156\x74\57\160\162\157\146\151\x6c\x65", array(), array(), array("\160\162\157\x66\151\154\145\137\151\155\x61\147\145" => $file), array()); $profileImages = Image::where("\164\171\x70\x65", "\75", "\x75\163\145\162")->where("\x63\162\x65\x61\164\x65\144\137\x62\x79", "\75", $editor->id)->get(); $this->assertTrue($profileImages->count() === 1, "\106\157\165\x6e\144\40\160\x72\x6f\146\x69\154\145\x20\151\155\x61\x67\145\163\40\144\157\145\x73\x20\x6e\157\164\x20\x6d\141\164\x63\150\x20\x75\160\154\157\x61\x64\40\x63\157\x75\x6e\x74"); $imagePath = public_path($profileImages->first()->path); $this->assertTrue(file_exists($imagePath)); $userDelete = $this->asAdmin()->delete($editor->getEditUrl()); $userDelete->assertStatus(302); $this->assertDatabaseMissing("\x69\x6d\141\147\x65\x73", array("\164\171\x70\x65" => "\165\163\x65\162", "\x63\162\x65\x61\164\145\x64\x5f\142\171" => $editor->id)); $this->assertDatabaseMissing("\151\155\x61\x67\x65\x73", array("\x74\x79\160\x65" => "\x75\163\x65\x72", "\x75\160\x6c\157\141\144\x65\144\137\x74\x6f" => $editor->id)); $this->assertFalse(file_exists($imagePath)); } public function test_deleted_unused_images() { $page = $this->entities->page(); $admin = $this->users->admin(); $this->actingAs($admin); $imageName = "\x75\156\x75\163\145\x64\55\151\x6d\141\x67\145\56\160\156\147"; $relPath = $this->files->expectedImagePath("\x67\x61\154\154\x65\x72\x79", $imageName); $this->files->deleteAtRelativePath($relPath); $upload = $this->files->uploadGalleryImage($this, $imageName, $page->id); $upload->assertStatus(200); $image = Image::where("\x74\171\160\x65", "\x3d", "\x67\141\x6c\x6c\145\x72\x79")->first(); $pageRepo = app(PageRepo::class); $pageRepo->update($page, array("\x6e\141\x6d\145" => $page->name, "\150\164\155\x6c" => $page->html . "\x3c\x69\155\x67\x20\x73\162\143\75\42{$image->url}\x22\76", "\163\x75\x6d\x6d\x61\x72\x79" => '')); $imageService = app(ImageService::class); $toDelete = $imageService->deleteUnusedImages(true, true); $this->assertCount(0, $toDelete); $pageRepo->update($page, array("\156\141\x6d\x65" => $page->name, "\x68\x74\x6d\x6c" => "\x3c\x70\76\x48\x65\154\x6c\157\x3c\x2f\160\x3e", "\163\165\x6d\155\x61\162\171" => '')); $imageService = app(ImageService::class); $toDelete = $imageService->deleteUnusedImages(true, true); $this->assertCount(0, $toDelete); $toDelete = $imageService->deleteUnusedImages(false, true); $this->assertCount(1, $toDelete); $page->revisions()->delete(); $toDelete = $imageService->deleteUnusedImages(true, true); $this->assertCount(1, $toDelete); $absPath = public_path($relPath); $this->assertTrue(file_exists($absPath), "\105\x78\151\163\x74\x69\x6e\x67\40\x75\x70\154\x6f\x61\x64\145\144\40\146\x69\154\145\x20\141\164\x20\x70\141\x74\x68\x20{$absPath}\x20\x65\x78\x69\x73\164\163"); $toDelete = $imageService->deleteUnusedImages(true, false); $this->assertCount(1, $toDelete); $this->assertFalse(file_exists($absPath)); $this->files->deleteAtRelativePath($relPath); } }