| Current Path : /var/www/html/stolberg/web/core/modules/file/tests/src/Functional/ |
Linux ift1.ift-informatik.de 5.4.0-216-generic #236-Ubuntu SMP Fri Apr 11 19:53:21 UTC 2025 x86_64 |
| Current File : /var/www/html/stolberg/web/core/modules/file/tests/src/Functional/FilePrivateTest.php |
<?php
declare(strict_types=1);
namespace Drupal\Tests\file\Functional;
use Drupal\file\Entity\File;
use Drupal\node\Entity\NodeType;
use Drupal\user\RoleInterface;
/**
* Uploads a test to a private node and checks access.
*
* @group file
*/
class FilePrivateTest extends FileFieldTestBase {
/**
* {@inheritdoc}
*/
protected static $modules = ['node_access_test', 'field_test'];
/**
* {@inheritdoc}
*/
protected $defaultTheme = 'stark';
/**
* {@inheritdoc}
*/
protected function setUp(): void {
parent::setUp();
node_access_test_add_field(NodeType::load('article'));
node_access_rebuild();
\Drupal::state()->set('node_access_test.private', TRUE);
// This test expects unused managed files to be marked as a temporary file.
$this->config('file.settings')
->set('make_unused_managed_files_temporary', TRUE)
->save();
}
/**
* Tests file access for file uploaded to a private node.
*/
public function testPrivateFile(): void {
$node_storage = $this->container->get('entity_type.manager')->getStorage('node');
/** @var \Drupal\Core\File\FileSystemInterface $file_system */
$file_system = \Drupal::service('file_system');
$type_name = 'article';
$field_name = $this->randomMachineName();
$this->createFileField($field_name, 'node', $type_name, ['uri_scheme' => 'private']);
$test_file = $this->getTestFile('text');
$nid = $this->uploadNodeFile($test_file, $field_name, $type_name, TRUE, ['private' => TRUE]);
\Drupal::entityTypeManager()->getStorage('node')->resetCache([$nid]);
/** @var \Drupal\node\NodeInterface $node */
$node = $node_storage->load($nid);
$node_file = File::load($node->{$field_name}->target_id);
// Ensure the file can be viewed.
$this->drupalGet('node/' . $node->id());
$this->assertSession()->responseContains($node_file->getFilename());
// Ensure the file can be downloaded.
$this->drupalGet($node_file->createFileUrl(FALSE));
$this->assertSession()->statusCodeEquals(200);
$this->drupalLogOut();
// Ensure the file cannot be downloaded after logging out.
$this->drupalGet($node_file->createFileUrl(FALSE));
$this->assertSession()->statusCodeEquals(403);
// Create a field with no view access. See
// field_test_entity_field_access().
$no_access_field_name = 'field_no_view_access';
$this->createFileField($no_access_field_name, 'node', $type_name, ['uri_scheme' => 'private']);
// Test with the field that should deny access through field access.
$this->drupalLogin($this->adminUser);
$nid = $this->uploadNodeFile($test_file, $no_access_field_name, $type_name, TRUE, ['private' => TRUE]);
\Drupal::entityTypeManager()->getStorage('node')->resetCache([$nid]);
$node = $node_storage->load($nid);
$node_file = File::load($node->{$no_access_field_name}->target_id);
// Ensure the file cannot be downloaded.
$file_url = $node_file->createFileUrl(FALSE);
$this->drupalGet($file_url);
$this->assertSession()->statusCodeEquals(403);
// Attempt to reuse the file when editing a node.
$edit = [];
$edit['title[0][value]'] = $this->randomMachineName();
$this->drupalGet('node/add/' . $type_name);
$this->submitForm($edit, 'Save');
$new_node = $this->drupalGetNodeByTitle($edit['title[0][value]']);
// Can't use submitForm() to set hidden fields.
$this->drupalGet('node/' . $new_node->id() . '/edit');
$this->getSession()->getPage()->find('css', 'input[name="' . $field_name . '[0][fids]"]')->setValue($node_file->id());
$this->getSession()->getPage()->pressButton('Save');
$this->assertSession()->addressEquals('node/' . $new_node->id());
// Make sure the submitted hidden file field is empty.
$new_node = \Drupal::entityTypeManager()->getStorage('node')->loadUnchanged($new_node->id());
$this->assertTrue($new_node->get($field_name)->isEmpty());
// Attempt to reuse the existing file when creating a new node, and confirm
// that access is still denied.
$edit = [];
$edit['title[0][value]'] = $this->randomMachineName();
// Can't use submitForm() to set hidden fields.
$this->drupalGet('node/add/' . $type_name);
$this->getSession()->getPage()->find('css', 'input[name="title[0][value]"]')->setValue($edit['title[0][value]']);
$this->getSession()->getPage()->find('css', 'input[name="' . $field_name . '[0][fids]"]')->setValue($node_file->id());
$this->getSession()->getPage()->pressButton('Save');
$new_node = $this->drupalGetNodeByTitle($edit['title[0][value]']);
$this->assertSession()->addressEquals('node/' . $new_node->id());
// Make sure the submitted hidden file field is empty.
$new_node = \Drupal::entityTypeManager()->getStorage('node')->loadUnchanged($new_node->id());
$this->assertTrue($new_node->get($field_name)->isEmpty());
// Now make file_test_file_download() return everything.
\Drupal::state()->set('file_test.allow_all', TRUE);
// Delete the node.
$node->delete();
// Ensure the temporary file can still be downloaded by the owner.
$this->drupalGet($file_url);
$this->assertSession()->statusCodeEquals(200);
// Ensure the temporary file cannot be downloaded by an anonymous user.
$this->drupalLogout();
$this->drupalGet($file_url);
$this->assertSession()->statusCodeEquals(403);
// Ensure the temporary file cannot be downloaded by another user.
$account = $this->drupalCreateUser();
$this->drupalLogin($account);
$this->drupalGet($file_url);
$this->assertSession()->statusCodeEquals(403);
// As an anonymous user, create a temporary file with no references and
// confirm that only the session that uploaded it may view it.
$this->drupalLogout();
user_role_change_permissions(
RoleInterface::ANONYMOUS_ID,
[
"create $type_name content" => TRUE,
'access content' => TRUE,
]
);
$test_file = $this->getTestFile('text');
$this->drupalGet('node/add/' . $type_name);
$edit = ['files[' . $field_name . '_0]' => $file_system->realpath($test_file->getFileUri())];
$this->submitForm($edit, 'Upload');
/** @var \Drupal\file\FileStorageInterface $file_storage */
$file_storage = $this->container->get('entity_type.manager')->getStorage('file');
$files = $file_storage->loadByProperties(['uid' => 0]);
$this->assertCount(1, $files, 'Loaded one anonymous file.');
$file = end($files);
$this->assertTrue($file->isTemporary(), 'File is temporary.');
$usage = $this->container->get('file.usage')->listUsage($file);
$this->assertEmpty($usage, 'No file usage found.');
$file_url = $file->createFileUrl(FALSE);
// Ensure the anonymous uploader has access to the temporary file.
$this->drupalGet($file_url);
$this->assertSession()->statusCodeEquals(200);
// Close the prior connection and remove the session cookie.
$this->getSession()->reset();
// Ensure that a different anonymous user cannot access the temporary file.
$this->drupalGet($file_url);
$this->assertSession()->statusCodeEquals(403);
// As an anonymous user, create a permanent file, then remove all
// references to the file (so that it becomes temporary again) and confirm
// that only the session that uploaded it may view it.
$test_file = $this->getTestFile('text');
$this->drupalGet('node/add/' . $type_name);
$edit = [];
$edit['title[0][value]'] = $this->randomMachineName();
$edit['files[' . $field_name . '_0]'] = $file_system->realpath($test_file->getFileUri());
$this->submitForm($edit, 'Save');
$new_node = $this->drupalGetNodeByTitle($edit['title[0][value]']);
$file_id = $new_node->{$field_name}->target_id;
$file = File::load($file_id);
$this->assertTrue($file->isPermanent(), 'File is permanent.');
// Remove the reference to this file.
$new_node->{$field_name} = [];
$new_node->save();
$file = File::load($file_id);
$this->assertTrue($file->isTemporary(), 'File is temporary.');
$usage = $this->container->get('file.usage')->listUsage($file);
$this->assertEmpty($usage, 'No file usage found.');
$file_url = $file->createFileUrl(FALSE);
// Ensure the anonymous uploader has access to the temporary file.
$this->drupalGet($file_url);
$this->assertSession()->statusCodeEquals(200);
// Close the prior connection and remove the session cookie.
$this->getSession()->reset();
// Ensure that a different anonymous user cannot access the temporary file.
$this->drupalGet($file_url);
$this->assertSession()->statusCodeEquals(403);
// As an anonymous user, create a permanent file that is referenced by a
// published node and confirm that all anonymous users may view it.
$test_file = $this->getTestFile('text');
$this->drupalGet('node/add/' . $type_name);
$edit = [];
$edit['title[0][value]'] = $this->randomMachineName();
$edit['files[' . $field_name . '_0]'] = $file_system->realpath($test_file->getFileUri());
$this->submitForm($edit, 'Save');
$new_node = $this->drupalGetNodeByTitle($edit['title[0][value]']);
$file = File::load($new_node->{$field_name}->target_id);
$this->assertTrue($file->isPermanent(), 'File is permanent.');
$usage = $this->container->get('file.usage')->listUsage($file);
$this->assertCount(1, $usage, 'File usage found.');
$file_url = $file->createFileUrl(FALSE);
// Ensure the anonymous uploader has access to the file.
$this->drupalGet($file_url);
$this->assertSession()->statusCodeEquals(200);
// Close the prior connection and remove the session cookie.
$this->getSession()->reset();
// Ensure that a different anonymous user can access the file.
$this->drupalGet($file_url);
$this->assertSession()->statusCodeEquals(200);
// As an anonymous user, create a permanent file that is referenced by an
// unpublished node and confirm that no anonymous users may view it (even
// the session that uploaded the file) because they cannot view the
// unpublished node.
$test_file = $this->getTestFile('text');
$this->drupalGet('node/add/' . $type_name);
$edit = [];
$edit['title[0][value]'] = $this->randomMachineName();
$edit['files[' . $field_name . '_0]'] = $file_system->realpath($test_file->getFileUri());
$this->submitForm($edit, 'Save');
$new_node = $this->drupalGetNodeByTitle($edit['title[0][value]']);
$new_node->setUnpublished();
$new_node->save();
$file = File::load($new_node->{$field_name}->target_id);
$this->assertTrue($file->isPermanent(), 'File is permanent.');
$usage = $this->container->get('file.usage')->listUsage($file);
$this->assertCount(1, $usage, 'File usage found.');
$file_url = $file->createFileUrl(FALSE);
// Ensure the anonymous uploader cannot access to the file.
$this->drupalGet($file_url);
$this->assertSession()->statusCodeEquals(403);
// Close the prior connection and remove the session cookie.
$this->getSession()->reset();
// Ensure that a different anonymous user cannot access the temporary file.
$this->drupalGet($file_url);
$this->assertSession()->statusCodeEquals(403);
}
}