FileSaveUploadTest::testHandleDangerousFile

Test dangerous file handling.

File

modules/simpletest/tests/file.test, line 741

This provides SimpleTests for the core file handling functionality. These include FileValidateTest and FileSaveTest.

Code

function testHandleDangerousFile() {
  // Allow the .php extension and make sure it gets renamed to .txt for
  // safety. Also check to make sure its MIME type was changed.
  $edit = array(
    'file_test_replace' => FILE_EXISTS_REPLACE, 
    'files[file_test_upload]' => drupal_realpath($this->phpfile->uri), 
    'is_image_file' => FALSE, 
    'extensions' => 'php',
  );

  $this->drupalPost('file-test/upload', $edit, t('Submit'));
  $this->assertResponse(200, t('Received a 200 response for posted test file.'));
  $message = t('For security reasons, your upload has been renamed to') . ' <em class="placeholder">' . $this->phpfile->filename . '.txt' . '</em>';
  $this->assertRaw($message, t('Dangerous file was renamed.'));
  $this->assertRaw(t('File MIME type is text/plain.'), t('Dangerous file\'s MIME type was changed.'));
  $this->assertRaw(t('You WIN!'), t('Found the success message.'));

  // Check that the correct hooks were called.
  $this->assertFileHooksCalled(array('validate', 'insert'));

  // Ensure dangerous files are not renamed when insecure uploads is TRUE.
  // Turn on insecure uploads.
  variable_set('allow_insecure_uploads', 1);
  // Reset the hook counters.
  file_test_reset();

  $this->drupalPost('file-test/upload', $edit, t('Submit'));
  $this->assertResponse(200, t('Received a 200 response for posted test file.'));
  $this->assertNoRaw(t('For security reasons, your upload has been renamed'), t('Found no security message.'));
  $this->assertRaw(t('File name is !filename', array('!filename' => $this->phpfile->filename)), t('Dangerous file was not renamed when insecure uploads is TRUE.'));
  $this->assertRaw(t('You WIN!'), t('Found the success message.'));

  // Check that the correct hooks were called.
  $this->assertFileHooksCalled(array('validate', 'insert'));

  // Turn off insecure uploads.
  variable_set('allow_insecure_uploads', 0);
}