function ManagedFileFidValidationTest::testOtherUsersFileIdNotAcceptedWithUpload

Tests that other users' file IDs are rejected even with a valid upload.

File

core/modules/file/tests/src/Functional/ManagedFileFidValidationTest.php, line 102

Class

ManagedFileFidValidationTest

Tests the file validation in the ManagedFile element for private files.

Namespace

Code

public function testOtherUsersFileIdNotAcceptedWithUpload() : void {
  $this->drupalLogin($this->anotherUser);
  $owner_fid = $this->ownerFile
    ->id();
  $test_file = $this->getTestFile('text');
  // The other user visits the form with the owner's file ID AND uploads a
  // legitimate file.
  $this->drupalGet('file/test/1/1/1/' . $owner_fid);
  $this->submitForm([
    'files[nested_file][]' => \Drupal::service('file_system')->realpath($test_file->getFileUri()),
  ], 'Save');
  $response = $this->getSession()
    ->getPage()
    ->getText();
  $uploaded_fid = $this->getLastFileId();
  $this->assertSession()
    ->pageTextContains('The file ids are');
  $contains_owner_file = str_contains($response, (string) $owner_fid);
  $contains_uploaded = str_contains($response, (string) $uploaded_fid);
  $this->assertFalse($contains_owner_file);
  $this->assertTrue($contains_uploaded);
}