function ImageStyleDownloadAccessControlTest::testPrivateThroughPublicRoute

Ensures that private:// access is forbidden through image.style_public.

File

core/modules/image/tests/src/Functional/ImageStyleDownloadAccessControlTest.php, line 76

Class

ImageStyleDownloadAccessControlTest

Tests access control for downloading image styles.

Namespace

Code

public function testPrivateThroughPublicRoute() : void {
    $this->fileSystem
        ->copy(\Drupal::root() . '/core/tests/fixtures/files/image-1.png', 'private://image.png');
    // Manually create the file record for the private:// file as we want it
    // to be temporary to pass hook_download() acl's.
    $values = [
        'uid' => $this->rootUser
            ->id(),
        'status' => 0,
        'filename' => 'image.png',
        'uri' => 'private://image.png',
        'filesize' => filesize('private://image.png'),
        'filemime' => 'image/png',
    ];
    $private_file = File::create($values);
    $private_file->save();
    $this->assertNotFalse(getimagesize($private_file->getFileUri()));
    $token = $this->style
        ->getPathToken('private://image.png');
    $public_route_private_scheme = Url::fromRoute('image.style_public', [
        'image_style' => $this->style
            ->id(),
        'scheme' => 'private',
    ])
        ->setAbsolute(TRUE);
    $generate_url = $public_route_private_scheme->toString() . '/image.png?itok=' . $token;
    $this->drupalLogin($this->rootUser);
    $this->drupalGet($generate_url);
    $this->drupalGet(PublicStream::basePath() . '/styles/' . $this->style
        ->id() . '/private/image.png');
    $this->assertSession()
        ->statusCodeEquals(403);
}