function FileSaveUploadTest::testHandleDangerousFile
7.x file.test | FileSaveUploadTest::testHandleDangerousFile() |
Test dangerous file handling.
File
- drupal-7.x/
modules/ simpletest/ tests/ file.test, line 741 - This provides SimpleTests for the core file handling functionality. These include FileValidateTest and FileSaveTest.
Class
- FileSaveUploadTest
- Test the file_save_upload() function.
Code
function testHandleDangerousFile() {
// Allow the .php extension and make sure it gets renamed to .txt for
// safety. Also check to make sure its MIME type was changed.
$edit = array(
'file_test_replace' => FILE_EXISTS_REPLACE,
'files[file_test_upload]' => drupal_realpath($this->phpfile->uri),
'is_image_file' => FALSE,
'extensions' => 'php',
);
$this->drupalPost('file-test/upload', $edit, t('Submit'));
$this->assertResponse(200, 'Received a 200 response for posted test file.');
$message = t('For security reasons, your upload has been renamed to') . ' <em class="placeholder">' . $this->phpfile->filename . '.txt' . '</em>';
$this->assertRaw($message, 'Dangerous file was renamed.');
$this->assertRaw(t('File MIME type is text/plain.'), "Dangerous file's MIME type was changed.");
$this->assertRaw(t('You WIN!'), 'Found the success message.');
// Check that the correct hooks were called.
$this->assertFileHooksCalled(array('validate', 'insert'));
// Ensure dangerous files are not renamed when insecure uploads is TRUE.
// Turn on insecure uploads.
variable_set('allow_insecure_uploads', 1);
// Reset the hook counters.
file_test_reset();
$this->drupalPost('file-test/upload', $edit, t('Submit'));
$this->assertResponse(200, 'Received a 200 response for posted test file.');
$this->assertNoRaw(t('For security reasons, your upload has been renamed'), 'Found no security message.');
$this->assertRaw(t('File name is !filename', array('!filename' => $this->phpfile->filename)), 'Dangerous file was not renamed when insecure uploads is TRUE.');
$this->assertRaw(t('You WIN!'), 'Found the success message.');
// Check that the correct hooks were called.
$this->assertFileHooksCalled(array('validate', 'insert'));
// Turn off insecure uploads.
variable_set('allow_insecure_uploads', 0);
}