Index: modules/upload/upload.test =================================================================== RCS file: /cvs/drupal/drupal/modules/upload/upload.test,v retrieving revision 1.3 diff -u -r1.3 upload.test --- modules/upload/upload.test 6 Jun 2008 10:36:44 -0000 1.3 +++ modules/upload/upload.test 27 Jul 2008 22:50:38 -0000 @@ -1,7 +1,68 @@ $value) { + $edit[$key . '_default'] = $value; + if ($rid !== NULL && $key != 'upload_list' && $key != 'upload_max_resolution') { + $edit[$key . '_' . $rid] = $value; + } + } + $this->drupalPost('admin/settings/uploads', $edit, 'Save configuration'); + $this->assertText('The configuration options have been saved.', 'Upload setting saved.'); + } + + /** + * Upload file to specified node. + * + * @param object $node Node object. + * @param string $filename Name of file to upload. + * @param boolean $assert Assert that the node was successfully updated. + */ + function uploadFile($node, $filename, $assert = TRUE) { + $edit = array(); + $edit['files[upload]'] = $filename; //edit-upload + $this->drupalPost('node/' . $node->nid . '/edit', $edit, t('Save')); + if ($assert) { + $this->assertRaw(t('Page %title has been updated.', array('%title' => $node->title)), 'File attached successfully.'); + } + } + + /** + * Check that uploaded file is accessible and verify the contents against the original. + * + * @param string $filename Name of file to verifiy. + */ + function checkUploadedFile($filename) { + $file = realpath(file_directory_path() . '/' . $filename); + $this->drupalGet(file_directory_path() . '/' . $filename); + $this->assertResponse(array(200), 'Uploaded ' . $filename . ' is accessible.'); + $this->assertEqual(file_get_contents($file), $this->drupalGetContent(), 'Uploaded contents of ' . $filename . ' verified.'); + } + + /** + * Get the role id of the 'simpletest' role associated with a SimpleTest test user. + * + * @param object $user User object. + * @return interger SimpleTest role id. + */ + function getSimpletestRoleId($user) { + foreach ($user->roles as $rid => $role) { + if (strpos($role, 'simpletest') !== FALSE) { + return $rid; + } + } + return NULL; + } +} + +class UploadTestCase extends UploadBaseTest { /** * Implementation of getInfo(). */ @@ -13,10 +74,6 @@ ); } - function setUp() { - parent::setUp('upload'); - } - /** * Create node; upload files to node; and edit, and delete uploads. */ @@ -145,59 +202,82 @@ $maxsize = format_size(parse_size(($settings['upload_uploadsize'] * 1024) . 'KB')); // Won't parse decimals. $this->assertRaw(t('The selected file %name could not be uploaded. The file is %filesize exceeding the maximum file size of %maxsize.', array('%name' => $filename, '%filesize' => $filesize, '%maxsize' => $maxsize)), t('File upload was blocked since it was larger than maxsize.')); } +} - function setUploadSettings($settings, $rid = NULL) { - $edit = array(); - foreach ($settings as $key => $value) { - $edit[$key . '_default'] = $value; - if ($rid !== NULL && $key != 'upload_list' && $key != 'upload_max_resolution') { - $edit[$key . '_' . $rid] = $value; - } - } - $this->drupalPost('admin/settings/uploads', $edit, 'Save configuration'); - $this->assertText('The configuration options have been saved.', 'Upload setting saved.'); - } - /** - * Upload file to specified node. - * - * @param object $node Node object. - * @param string $filename Name of file to upload. - * @param boolean $assert Assert that the node was successfully updated. - */ - function uploadFile($node, $filename, $assert = TRUE) { - $edit = array(); - $edit['files[upload]'] = $filename; //edit-upload - $this->drupalPost('node/' . $node->nid . '/edit', $edit, t('Save')); - if ($assert) { - $this->assertRaw(t('Page %title has been updated.', array('%title' => $node->title)), 'File attached successfully.'); - } - } +class PrivateUploadTestCase extends UploadBaseTest { /** - * Check that uploaded file is accessible and verify the contents against the original. - * - * @param string $filename Name of file to verifiy. + * Implementation of getInfo(). */ - function checkUploadedFile($filename) { - $file = realpath(file_directory_path() . '/' . $filename); - $this->drupalGet(file_directory_path() . '/' . $filename); - $this->assertResponse(array(200), 'Uploaded ' . $filename . ' is accessible.'); - $this->assertEqual(file_get_contents($file), $this->drupalGetContent(), 'Uploaded contents of ' . $filename . ' verified.'); + function getInfo() { + return array( + 'name' => t('Private file transfer functionality'), + 'description' => t('Tests for private file transfers.'), + 'group' => t('Upload'), + ); } - + /** - * Get the role id of the 'simpletest' role associated with a SimpleTest test user. - * - * @param object $user User object. - * @return interger SimpleTest role id. + * enable private file transfers + * grant one role 'view uploaded files' permissions + * upload files to a node + * determine the download URL of the uploaded file + * log in as the user with the 'view uploaded files' permissions and ensure that they're able to view the file + * ensure that users without the 'view uploaded files' aren't able to view the file + * @return */ - function getSimpletestRoleId($user) { - foreach ($user->roles as $rid => $role) { - if (strpos($role, 'simpletest') !== FALSE) { - return $rid; - } + function testSetPrivateDownload() { + $admin_user = $this->drupalCreateUser(array('administer site configuration')); + $web_user = $this->drupalCreateUser(array('access content', 'edit any page content', 'upload files', 'view uploaded files')); + $noaccess_web_user = $this->drupalCreateUser(array('access content', 'edit any page content', 'upload files')); + + $this->drupalLogin($admin_user); + + // enable private file transfers + $edit = array(); + $edit['file_downloads'] = FILE_DOWNLOADS_PRIVATE; + $this->drupalPost('admin/settings/file-system', $edit, t('Save configuration')); + $this->assertText('The configuration options have been saved.', t('Download method saved.')); + + $this->drupalLogout(); + + // log in as the user with the 'view uploaded files' permissions + // and ensure that they're able to view the file + $this->drupalLogin($web_user); + + //upload files to a node + $node = $this->drupalCreateNode(); + $img_files = $this->drupalGetTestFiles('image'); + $files = array(current($img_files)->filename, next($img_files)->filename); + $this->uploadFile($node, $files[0]); + $this->uploadFile($node, $files[1]); + + // Check to see that uploaded file is listed and actually accessible. + $this->assertText(basename($files[0]), t('@file was found on node.', array('@file' => basename($files[0])))); + $this->assertText(basename($files[1]), t('@file was found on node.', array('@file' => basename($files[1])))); + + foreach($files as $file_url){ + $file_url = file_create_url(basename($file_url)); + $this->drupalGet($file_url); + $this->assertResponse(array(200), t("Uploaded @file is accessible for users with 'view uploaded files' permission.", array('@file' => $file_url))); + } + + $this->drupalLogout(); + + // login with the user that hasn't 'view uploaded files' permission + $this->drupalLogin($noaccess_web_user); + + // Check to see that uploaded file is NOT listed + $this->drupalGet('node/' . $node->nid); + $this->assertNoText(basename($files[0]), basename($files[0]) . ' not found on node.'); + $this->assertNoText(basename($files[1]), basename($files[1]) . ' not found on node.'); + + // ensure that the file is not accessible + foreach($files as $file_url){ + $file_url = file_create_url(basename($file_url)); + $this->drupalGet($file_url); + $this->assertResponse(array(403), t("Uploaded @file is not accessible for users without 'view uploaded files' permission.", array('@file' => $file_url))); } - return NULL; } }