tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Reject invalid uploads and expand flow tests.

Browse Source
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent 716a609f4e
commit 8f4851e576
9 changed files with 427 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/php/Unit/UploadTest.php
+44
View File
@@ -1,6 +1,7 @@
<?php
namespace Xxx\Tests\Unit;
use PHPUnit\Framework\Attributes\DataProvider;
use Xxx\Tests\Support\TestCase;
// The upload directory and the pending upload in get_data.lib.php and publish/post.lib.php
@@ -88,6 +89,49 @@ class UploadTest extends TestCase {
$this->assertFalse(save_uploaded_file());
}
public static function arrayTemporaryNames(): array {
return array(
'empty array' => array(array()),
'file list' => array(array('/tmp/not-an-upload')),
);
}
#[DataProvider('arrayTemporaryNames')]
public function testAnArrayTemporaryNameIsRefused(array $name): void {
$pending = $this->pending();
$_FILES['upload'] = array('tmp_name' => $name, 'name' => array('a.png'), 'error' => array(UPLOAD_ERR_OK));
$this->assertFalse(save_uploaded_file());
$_POST['uploaded'] = 'pending';
$this->assertFalse(save_uploaded_file(), 'an invalid new upload does not select the pending image');
$this->assertFileExists($pending);
$this->assertSame(basename($pending), $_SESSION['pending_upload']);
}
public static function missingTemporaryNames(): array {
return array(
'absent entry' => array(array()),
'absent name' => array(array('upload' => array('error' => UPLOAD_ERR_NO_FILE))),
'empty name' => array(array('upload' => array('tmp_name' => ''))),
);
}
#[DataProvider('missingTemporaryNames')]
public function testAMissingTemporaryNameLeavesThePendingUploadAlone(array $files): void {
$pending = $this->pending();
$_FILES = $files;
$this->assertFalse(save_uploaded_file());
$this->assertFileExists($pending);
$this->assertSame(basename($pending), $_SESSION['pending_upload']);
$_POST['uploaded'] = 'pending';
$this->assertSame($pending, save_uploaded_file());
}
public function testAMissingTemporaryFileIsNotSaved(): void {
$_FILES['upload'] = array('name' => 'a.png', 'tmp_name' => $this->tmp . '/missing', 'error' => UPLOAD_ERR_OK);
$this->assertFalse(save_uploaded_file());
$this->assertArrayNotHasKey('pending_upload', $_SESSION);
}
// Files in the upload directory: an old upload, a new one and a file that is not an upload
private function others(): array {
$files = array('old' => upload_dir() . '/' . str_repeat('c', 32), 'new' => upload_dir() . '/' . str_repeat('d', 32),